Threat actors conducted a large-scale password spray campaign targeting Azure CLI between June 12 and 21, 2026, making over 81 million login attempts originating primarily from LSHIY LLC infrastructure. Huntress detected 78 user account compromises across 64 customer organizations, with 2-4 accounts typically breached daily. The attack represents part of a broader surge in credential spray attacks across the cloud services landscape.
- Massive Password Spray Campaign Targeting Azure CLI - SecurityWe(opens in a new tab)
- Azure CLI Targeted in LSHIY Password Spray Campaign Across 64 Or(opens in a new tab)
// Get alerts for Microsoft Azure