Massive Password Spray Campaign Targeting Azure CLI

Hackers were seen making over 81 million login attempts originating from systems associated with hosting provider LSHIY. The post Massive Password Spray Campaign Targeting Azure CLI appeared first on SecurityWeek .

The article reports a massive password spray campaign abusing Azure CLI, with over 81 million login attempts sourced from infrastructure tied to hosting provider LSHIY, targeting Azure/Entra identities via automated credential guessing at scale.[4][6][7] This reflects a systematic, tool-driven attack pattern where common or weak passwords are tried across many accounts to avoid lockouts and gain initial cloud access.[4][7] From a CyberSE.AI perspective, such large-scale automation and scripting against cloud identity endpoints is analogous to hostile, automated use of AI-capable tooling to probe and exploit authentication surfaces, highlighting the need for continuous adversarial testing, strong MFA and passwordless strategies, and conditional access policies that restrict or monitor programmatic interfaces like Azure CLI.[3][6] Mapping this to AI security, organizations should ensure their AI agents and automation interacting with cloud APIs are hardened against credential abuse, monitored via red-teaming simulations, and governed by policies that detect and block high-volume, scripted access attempts indicative of malicious automated use.