Azure CLI Password Spray Compromises 78 Microsoft Accounts in 81M+ Attempts
What Happened — Researchers at Huntress observed an automated password‑spray campaign targeting Microsoft Azure’s command‑line interface (CLI). Over a two‑week window (June 12‑26) the attackers made more than 81 million login attempts from an IPv6 block owned by LSHIY LLC, successfully authenticating to at least 78 Azure accounts.
Why It Matters for Compliance & Audit Readiness
- Credential‑spray attacks exploit weak password policies and insufficient multi‑factor enforcement—exactly the controls SOC 2 CC6.1 (Logical Access) is designed to protect.
- Continuous evidence of access‑control enforcement (MFA usage, password‑strength monitoring, failed‑login alerts) is required to demonstrate due diligence during a SOC 2 audit.
- The incident underscores the need for documented security‑awareness training that reinforces safe credential practices for staff and contractors.
Who Is Affected – Cloud‑infrastructure providers, SaaS vendors, and any organization that provisions Azure CLI access for developers, DevOps, or IT staff.
Recommended Actions
- Verify that MFA is mandatory for all Azure CLI accounts and that conditional‑access policies block password‑spray patterns.
- Enable Azure AD sign‑in risk detection and integrate alerts into your SIEM for real‑time monitoring.
- Review and tighten password‑complexity requirements; enforce regular rotation where appropriate.
- Conduct a focused security‑awareness session on credential hygiene and the risks of password‑spray.
- Capture and retain logs of failed‑login attempts as audit evidence for SOC 2 CC6.1 compliance.
Source: The Hacker News
Technical Notes – The attack leveraged a high‑speed IPv6 address range (2a0a:d683::/32) to perform credential‑spray attempts against the Azure CLI authentication endpoint. No specific CVE is involved; the vector is a brute‑force technique exploiting weak passwords and the lack of enforced MFA on affected accounts.