Azure CLI Password Spraying: Lessons for Server Security

The Growing Threat of Password SprayingIn recent months, cybercriminals have refined their techniques to bypass traditional security measures. One of...

The Growing Threat of Password Spraying

In recent months, cybercriminals have refined their techniques to bypass traditional security measures. One of the most concerning trends is the rise of password spraying attacks, where attackers use a small number of common passwords across many accounts to avoid triggering lockout policies. A recent large-scale campaign targeting Azure CLI highlighted this threat, with over 81 million attempts recorded in just two weeks. This incident serves as a stark reminder that identity is the new perimeter, and organisations must adapt their security strategies accordingly.

Anatomy of the Attack

The campaign, which took place between June 12 and 26, 2026, exploited the OAuth Resource Owner Password Credentials (ROPC) flow, a legacy mechanism that allows applications to authenticate users with just a username and password. Unlike interactive logins, ROPC bypasses additional security checks, making it an attractive vector for attackers. By leveraging credentials leaked from previous breaches, the attackers managed to compromise at least 78 accounts across 64 organisations. The attack pattern was notably stealthy: instead of bombarding a single account with many guesses, they distributed a few attempts across numerous identities, making detection more difficult.

Why MFA Alone Isn't Enough

One of the most alarming findings was that many organisations with Multi-Factor Authentication (MFA) enabled were still affected. This happened because their MFA policies did not cover non-interactive login flows like ROPC. In some cases, MFA was only enforced for specific applications or user groups, leaving gaps that attackers exploited. At least eight of the affected organisations had no MFA policy at all. This incident underscores the need for comprehensive conditional access policies that apply MFA universally, including to service principals and legacy authentication protocols.

Practical Steps to Harden Your Environment

To protect your servers and cloud infrastructure from similar attacks, consider the following measures:

Enforce MFA for all users and applications, ensuring that policies cover both interactive and non-interactive sign-ins.
Disable or restrict legacy authentication flows like ROPC wherever possible. Microsoft recommends migrating to modern authentication methods such as OAuth 2.0 with conditional access.
Limit the use of Azure CLI to only those who genuinely need it, especially non-administrative users. This reduces the attack surface.
Monitor for suspicious sign-in patterns, such as multiple failed attempts across many accounts or logins from unusual IP ranges, particularly IPv6 addresses associated with known malicious ASNs.
Implement intelligent lockout mechanisms that can detect and block distributed attacks without impacting legitimate users.

Responding to a Potential Compromise

If you suspect that a password spraying attack has succeeded, treat it as a potential security incident. Immediately initiate your incident response plan, which should include revoking sessions and tokens, forcing password changes, and rotating any reused credentials. Additionally, review your logs for signs of lateral movement or data exfiltration, and consider resetting privileges for affected accounts.

The Role of Centralised Security Management

For organisations managing multiple servers, coordinating security efforts can be challenging. A centralised approach to threat intelligence and IP reputation can significantly enhance your defences. By aggregating data from all your machines, you can quickly identify and block malicious IPs across your entire infrastructure. This is where solutions like Abuse Shield come into play. Abuse Shield centralises protection by automatically blocking malicious IPs, managing fail2ban across multiple servers, and sharing a common reputation feed. This ensures that if one server detects an attack, all others are immediately protected, reducing the window of opportunity for attackers.

Conclusion

The Azure CLI password spraying campaign is a wake-up call for businesses in Spain and across Europe. As cyber threats evolve, relying on basic security measures is no longer sufficient. By implementing robust MFA policies, disabling legacy protocols, and leveraging centralised security tools, you can significantly reduce your risk. Remember, in the cloud, your identity is your perimeter—make sure it's well defended.

Put these ideas into practice

Talk to ALMC about a solution for your business. Explore your options or contact our team.

Results without leaving the page.