Azure CLI password spraying compromises dozens of Microsoft accounts
Source headline: Azure CLI Password Spray Hits at Least 78 Microsoft Accounts in 81M+ Attempts
Intelligence Summary
Security researchers report a large password-spraying campaign targeting Azure CLI authentication. The activity attempted logins against at least 78 Microsoft accounts using over 81 million tries. The traffic was traced to an IPv6 range associated with LSHIY LLC. If successful, the attackers could gain access to cloud resources and perform further actions under compromised identities. Azure CLI users and administrators should review authentication logs, enforce strong MFA, and watch for suspicious login patterns from abnormal IP ranges.
Recommended Action
Inventory where Azure CLI runs in your environment and treat this as an active remediation item. Until then, watch authentication and outbound traffic logs for the indicators described in the source. This signal rests on a single report, so corroborate it before acting on anything irreversible.