81 Million Azure CLI Attempts Compromise 78 Accounts via ROPC Bypass

Huntress telemetry shows the campaign averaged two to four successful compromises per day until June 22 when the daily count spiked to 30 identities. The attackers relied exclusively on username-password pairs drawn from prior breach compilations and routed all traffic through the IPv6 block 2a0a:d683::/32. Because the requests used Azure CLI client identifiers the traffic evaded Conditional Access policies that were scoped to specific applications user groups or trusted locations rather than all cloud apps and all client types.

Microsoft has documented since 2021 that ROPC is incompatible with modern MFA enforcement and should be replaced by device-code or interactive flows yet the grant remains available for backward compatibility. The same LSHIY infrastructure has been observed in parallel credential-spray waves against other ASNs with overall failed attempts per protected tenant rising 155-fold since late May. Eight of the victim organizations had no MFA policy at all while the remainder had partial rules that left the CLI vector open.

The pattern indicates systematic testing of legacy authorization paths rather than targeted espionage. Organizations that treat Conditional Access as a one-time configuration rather than a continuously validated matrix of app user and context conditions will continue to absorb these low-and-slow sprays. Microsoft has not published a firm removal date for ROPC support in Azure AD.