As reported by BleepingComputer, Huntress documented a staggering 155x increase in password spraying attacks during the first half of 2026, with a single campaign generating over 81 million login attempts in just two weeks. The technical detail that deserves the most attention from defenders is not the volume — it is the exploitation of Resource Owner Password Credentials (ROPC), a legacy OAuth grant that silently sidesteps the MFA policies organizations believe are protecting them.

Key Takeaway: As reported by BleepingComputer, Huntress documented a staggering 155x increase in password spraying attacks during the first half of 2026, with a single campaign generating over 81 million login attempts in just two weeks.

The ROPC Problem Is Structural, Not Tactical

Most security teams configure MFA through Conditional Access Policies in Microsoft Entra ID and assume the job is done. The Huntress findings expose a dangerous assumption: CAPs typically target interactive sign-in flows. ROPC, by design, is non-interactive. It accepts a username and password directly at the /token endpoint and returns an access token — no browser redirect, no MFA challenge, no device compliance check.

This means an organization can have a robust MFA deployment, pass its compliance audits, and still leave a wide-open authentication path that attackers can trivially abuse. The LSHIY campaign proved this at scale, compromising 78 accounts in a two-week window despite those accounts being nominally protected by MFA.

The fundamental issue is that defenders think about authentication at the identity layer, while attackers operate at the protocol layer. ROPC is a protocol-level bypass that renders identity-layer controls irrelevant for that specific flow.

Why Credential Reuse Amplifies the Threat

The campaign combined password spraying with credential stuffing — reusing valid username-password pairs from prior breaches. This hybrid approach is more efficient than traditional spraying because each attempt has a higher probability of success. When the target organization has not enforced password rotation after known breaches, and ROPC is enabled, the attacker gets a valid session token with zero MFA friction.

Huntress noted no post-compromise activity, suggesting credential harvesting for dark web resale. This is arguably worse for defenders in the long term: compromised credentials enter circulation and may be used months later by different threat actors, making attribution and incident scoping significantly harder.

Who Is Most Exposed

Why Credential Reuse Amplifies the Threat
Azure-heavy environments using Azure CLI or programmatic access patterns that rely on ROPC for automation
SMBs and mid-market organizations with MFA deployed via default CAP templates that do not explicitly block legacy authentication
Organizations with high employee turnover where stale credentials from former staff remain valid and were never rotated
Environments without continuous credential exposure monitoring — if you are not checking your usernames against breach corpora, you are flying blind

Shield53 Recommendations

  • Disable ROPC immediately. In Microsoft Entra ID, this can be done by disabling the legacy authentication grant through Conditional Access policies that explicitly block non-interactive flows, or by using the Set-MsolCompanySettings / Entra admin controls to reject legacy auth. Microsoft has been recommending this since 2020 — there is no legitimate reason to keep ROPC enabled in 2026.
  • Audit every authentication path. Do not assume your CAP covers all flows. Pull Entra sign-in logs and filter for non-interactive sign-ins, ROPC grant types, and legacy auth client applications. Any traffic there is your attack surface.
  • Enforce password rotation for credential exposure. Integrate a credential exposure monitoring service (Have I Been Pwned API, Microsoft Entra ID Protection, or a commercial TI feed) and force resets for any user whose credentials appear in breach data.
  • Implement geographic and IP-based anomaly detection. The LSHIY campaign originated from a specific IPv6 range. Entra ID Risky IP detection and conditional access geofencing would have flagged or blocked this traffic.
  • Transition automation to managed identities or workload identity federation. Replace any scripts or service accounts using ROPC with Azure managed identities or federated identity credentials that do not require stored passwords.
  • Monitor for the absence of MFA claims. Successful authentication events that lack an MFA claim should generate alerts. If your SIEM is not correlating authenticationMethod fields against expected values, you are missing the most important signal.

The broader lesson is that authentication security is not a checkbox exercise. Every protocol, every grant type, every client application represents a distinct attack surface that must be individually evaluated. The LSHIY campaign succeeded not because MFA failed — but because defenders assumed MFA coverage was universal when it was not.