OAuth ROPC flow risks bypassing MFA in Azure

Between June 12 and 21, 2026, Azure CLI faced a deluge: 81 million login attempts. Huntress tracked this massive campaign, confirming that legacy OAuth ROPC flows let attackers sidestep multi-factor authentication entirely. Standard MFA configurations offer little protection here because this deprecated method ships credentials straight to the token endpoint, never triggering an interactive security prompt.

The data exposes a harsh reality. Threat actors hunt for gaps where MFA isn't enforced across every cloud application or user group. Huntress found 78 compromised accounts across 64 organizations; some victims had no MFA policy at all. The attack infrastructure leaned heavily on AS32167, linked to hosting provider LSHIY LLC. This choice highlights how easily bad actors leverage permissive network environments to validate stolen credentials.

Below, we dissect the mechanics of these password spray attacks and the specific authentication gaps enabling MFA bypass. Securing identities demands more than basic MFA deployment; it requires closing the door on non-interactive authentication vectors.

The Mechanics of Password Spray Attacks Using Legacy OAuth Flows

OAuth ROPC Flow Mechanics and Azure CLI Vulnerabilities

When applications use the OAuth ROPC flow, passwords travel directly to the `/token` endpoint. This process completely sidesteps interactive MFA prompts. Unlike modern flows that redirect users to a secure login portal, this legacy mechanism lets applications swap user credentials for access tokens in the background. Threat actors exploit this design flaw during password spray campaigns. They submit low-volume credential pairs against numerous accounts to evade standard lockout thresholds.

Identity attacks frequently rely on such spraying techniques, yet organizations often leave these legacy flows exposed by accident. The Azure CLI campaign documented by Huntress illustrated this vulnerability clearly, logging over 81 million login attempts within a single two-week window.

MFA Bypass Risks When Legacy OAuth Flows Remain Enabled

Submitting credentials directly to the token endpoint allows OAuth ROPC to bypass interactive MFA prompts entirely. Organizations with thorough MFA coverage for standard applications remained vulnerable because their policies did not strictly cover legacy authentication paths like Azure CLI. The campaign exploited the OAuth Resource Owner Password Credentials (ROPC) flow, a legacy authentication method that allows credentials to be transmitted directly to Azure AD. This mechanism effectively bypasses modern MFA and Conditional Access Policy enforcement.

During the observed two-week window, hackers compromised between 2-4 accounts daily despite existing security perimeters. ROPC is considered problematic because it doesn't offer support for modern auth flows like MFA or SSO.

ROPC was designed for trusted, first-party applications, not public clients where secrets cannot be secured. Consequently, identity attacks attributed to password spray continue to succeed where MFA configuration fails to block non-interactive logins. Enabling MFA globally does not automatically secure legacy protocols unless you explicitly configure the system to reject them. These flows create a silent failure mode: authentication logs show success while security posture degrades. Disabling legacy authentication entirely eliminates this attack surface.

How Attackers Bypass MFA via the ROPC Authentication Gap

How OAuth ROPC Flow Bypasses MFA by Minting User-Delegated Tokens

The deprecated OAuth ROPC flow validates credentials directly at the token endpoint, minting a user-delegated token without triggering interactive MFA prompts. This legacy mechanism allows the protocol to transmit passwords straight to the `/token` endpoint, effectively circumventing modern MFA and SSO checks that rely on browser-based interaction. Huntress has observed the volume of credential spray attacks increase by over 155 times across our customer base in the past six months.

Attackers use this architectural oversight to bypass MFA distinctions, as the flow simply does not support the challenge required for the second factor. The protocol mints a valid access token upon receiving correct credentials, ignoring policies scoped to specific applications or user groups. Consequently, how MFA can be bypassed often reduces to a single configuration error: failing to block legacy authentication paths entirely. Immediate enforcement of Conditional Access policies is recommended to restrict these flows, as relying solely on MFA implementation without covering legacy protocols leaves the identity perimeter porous. Network operators must audit their Azure CLI exposure and disable Resource Owner Password Credentials flows to prevent token minting based solely on static secrets.

Exploiting the Azure CLI Gap with Legacy Authentication

Threat actors apply the OAuth ROPC flow to validate credential lists without triggering interactive MFA challenges. This method signals the identity provider to bypass modern conditional access policies that typically block non-browser requests. The mechanism exploits a protocol divergence where the resource owner password credentials flow accepts direct username and password pairs, minting valid tokens even when MFA is enabled but not strictly scoped to legacy protocols.

Monitoring activity logs for login attempts using the OAuth ROPC flow provides a critical detection signal for credential spray campaigns targeting cloud infrastructure. Maintaining compatibility with legacy scripts often inadvertently preserves this attack surface, forcing administrators to choose between functionality and strict security posture. Immediate enforcement of conditional access rules that explicitly block ROPC flows for all user groups is recommended. Network operators must recognize that standard MFA deployment offers false confidence if legacy authentication paths remain open. The presence of ROPC authentication attempts indicates active exploitation attempts requiring immediate policy intervention.

Why Thorough MFA Policies Fail Against Legacy Authentication Paths

Organizations remain exposed because Conditional Access policies often exclude legacy paths like OAuth ROPC. This gap allows attackers to validate credentials against Azure AD without triggering interactive MFA prompts. The mechanism mints a valid user-delegated token directly at the endpoint, rendering standard MFA coverage ineffective for unscoped applications.

The fundamental failure lies in assuming MFA enrollment equals universal protection. In reality, policies enforced only for specific user groups or non-trusted locations leave the OAuth ROPC channel open. This architecture permits direct password transmission to the token endpoint, completely bypassing modern authentication checks. Consequently, even enabled MFA provides no defense if the policy does not explicitly block or cover legacy protocols. Administrators must recognize that partial enforcement creates a false sense of security while attackers exploit these unmonitored vectors. Immediate auditing of Conditional Access rules is required to close these authentication gaps.

Enforcing MFA and Disabling ROPC to Secure Azure Environments

Why Azure Conditional Access Blocks Legacy OAuth ROPC Flows

Azure Conditional Access blocks legacy OAuth ROPC flows because this deprecated protocol bypasses interactive MFA prompts entirely. Although deprecated in OAuth 2.1, this authentication flow mints a new user-delegated token when receiving correct credentials, granting access without challenging the user. ROPC is considered problematic because it does not support modern auth flows like MFA or SSO, sending the password straight to the /token endpoint with no interactive MFA prompt. Operators must explicitly configure policies to address the authorization flow used across these incidents rather than relying on default MFA enforcement.

1. Ensure MFA policies are properly configured to address the specific authorization flow used in incidents. 2.

The critical gap exists when organizations assume global MFA settings cover non-interactive endpoints. Attackers exploit this by sending credentials directly to the token endpoint, avoiding the MFA trigger completely. Analysis of compromises revealed weaknesses where MFA was required for non-trusted locations only or was implemented but never enforced. A significant spike occurred around June 22, when 23 businesses were compromised. While threat actors succeeded despite MFA setups in some cases, organizations should ensure their MFA policies are properly configured to address the authorization flow used across these incidents.

Configuring Azure Conditional Access to Block Unknown BAV2ROPC User Agents

Administrators should create explicit Conditional Access rules to address legacy protocol usage that bypasses interactive security checks. The attacks targeting Azure CLI relied on the OAuth ROPC flow to validate credentials, allowing attackers to compromise accounts even if MFA was enabled but not configured to cover this specific flow.

1. Under Cloud apps or actions, select Block access for clients using legacy authentication.
2. Monitor Activity logs for specific identifiers to identify active spray attempts.

Enforcing strong authentication at the client level helps stop these flows. The OAuth ROPC flow allows credentials to transmit directly to Azure AD, skipping modern MFA prompts entirely. Detection requires monitoring Activity logs to identify active spray attempts. While technical controls like Smart Lockout often require minimal additional investment as many are included in Entra ID P1/P2 licenses, misconfigured policies leave networks exposed despite available protections. Operators relying on default MFA settings without explicit legacy blocking remain vulnerable to credential validation.

Validation Checklist for Enforcing MFA Across All User Groups and Locations

Administrators must validate that Conditional Access policies explicitly cover the application scope used in recent campaigns. Recent campaigns targeting Azure CLI exploited gaps where MFA was not enforced for specific legacy flows, compromising 78 accounts across 64 organizations. Organizations should ensure their MFA policies are properly configured to address the authorization flow used across these incidents. 3. Audit sign-in logs for user agent strings indicating bypass attempts.

The OAuth ROPC flow transmits passwords directly to the token endpoint, sidestepping modern security controls. Immediate enforcement of strict Conditional Access rules eliminates these legacy paths.

Monitoring Login Attempts and Reporting Malicious Infrastructure

AS32167 Infrastructure and LSHIY LLC Hosting Profile

AS32167 serves as the primary source for login attempts targeting Azure CLI environments. This autonomous system links directly to LSHIY LLC, an internet hosting provider with registration records in Hong Kong, Wuhan, and New York. Such geographic distribution complicates jurisdictional responses to abuse reports. These incidents form part of a broader wave of credential spray attacks spanning multiple ASNs. Guardz telemetry indicates that authentication attempts from such infrastructure grew by 50% over a recent 120-day window. This industrialization of access attempts highlights the sheer volume of traffic originating from these networks. Network teams must prioritize identifying authentication spikes from these known malicious IPs. Operators should also monitor specifically for OAuth ROPC requests because attackers utilized this flow to validate credentials against compromised password combo lists. Blocking based solely on ASN introduces operational risk if legitimate services share the range. The drawback lies in the collateral damage potential when a hosting provider serves mixed tenants. Operators must balance immediate threat mitigation with service availability. Securing distinct address space minimizes exposure to neighbor-based reputation contamination.

Implementing Login Monitoring for 155x Spray Volume Spikes

Detection logic must flag the Unknown(BAV2ROPC) user agent string to identify legacy protocol abuse attempting to bypass interactive MFA challenges. Administrators should configure alert thresholds based on the observed 155 times surge in credential spray volume documented over the past six months. This specific user agent indicates an OAuth ROPC flow request, a deprecated mechanism that transmits passwords directly to the token endpoint without triggering modern authentication prompts. Real-time log analysis tools help parse Azure Activity Logs for non-interactive sign-in patterns. Network teams should consider blocking legacy authentication flows where business processes allow, as monitoring alone cannot prevent credential validation if the protocol remains active. The limitation of reactive monitoring is the latency between initial compromise and alert generation, making proactive policy enforcement the primary defense layer. Administrators should establish workflows to report abuse, though Huntress noted receiving no response after reporting malicious activity to LSHIY via its abuse mechanism. Attackers frequently shift between IPv4 and IPv6 address spaces to evade static blocklists. Effective monitoring requires correlating login failure rates with source IP reputation data rather than relying solely on volume spikes. The cost of delayed detection is measurable; recent campaigns compromised dozens of organizations within a two-week window before containment.

Reporting Failures to Unresponsive Abuse Contacts at LSHIY

Huntress reported malicious activity to LSHIY via its abuse mechanism but received no response, confirming the operational risk of relying on unresponsive hosts. This silence leaves networks exposed as attackers industrialize access attempts from AS32167 infrastructure without fear of remediation. Reports exist indicating that IPv6 ranges associated with AS32167 and AS955, two ASNs operated by the firm, originate in China. Internal blocking becomes a necessary defense strategy when hosting providers ignore abuse tickets. Security teams should execute the following actions:

• Configure Conditional Access policies to deny authentication requests from identified malicious subnets.
• Disable legacy OAuth ROPC flows to prevent credential validation without interactive MFA challenges.
• Deploy automated filtering to drop traffic from autonomous systems associated with malicious activity.
• Implement strict ingress filtering to reduce the attack surface available to external threats.
• Audit existing MFA policies to ensure coverage for all cloud applications and user groups.

The failure of external reporting mechanisms necessitates a shift toward proactive resource management. Operators cannot wait for upstream cooperation when facing active credential harvesting.

References

• Digital Citizens Alliance report claims that millions of Americans
• Helping build a safer Internet by measuring BGP RPKI
• No (Bad) CAP: Inside an Ongoing LSHIY Password Spray