Between June 12 and 26, security firm Huntress watched a single campaign throw more than 81 million login attempts at Microsoft 365 accounts. It compromised 78 accounts across 64 organizations. The uncomfortable detail for anyone who assumed multi-factor authentication had them covered: in many of those cases, MFA was switched on and the attacker got in anyway, because of how the sign-in policies were configured.
What happened
This was a password-spraying attack, which is the quiet cousin of a brute-force. Instead of hammering one account with millions of guesses, the attacker takes username and password pairs that have leaked in past breaches and tries each one, slowly, across many accounts and many companies at once. Because your staff reuse passwords more than they would admit, some of those old, leaked passwords still work. The volume here (81 million attempts) is what made it show up on the radar; the technique itself is old and constant. Huntress reported that organizations now see an average of nearly 2,000 failed M365 login attempts per month, every month.
How it got past MFA
The clever part was the doorway. Rather than the normal web login, the attacker authenticated through the Azure command-line tool using a mechanism called ROPC (Resource Owner Password Credentials). ROPC sends a username and password straight to Microsoft's token endpoint and, critically, never triggers an interactive MFA prompt. In a tenant where the Conditional Access policies were written carefully, that path is blocked. In tenants where they were not, the attacker walked in with just the leaked password. Reported attribution points to infrastructure run by an entity called LSHIY LLC, but the "who" matters far less here than the "how."
Why this matters for a small business
Almost every small business runs on Microsoft 365, and almost every one of them believes "we have MFA turned on" is the end of the story. This campaign is a plain demonstration that MFA is only as strong as the policy around it. The failures Huntress saw were not exotic: MFA scoped to some apps but not "all cloud apps," MFA required of administrators but not regular staff, MFA enforced only from unfamiliar locations, or a policy left in "report-only" mode where it logs what it would have done but never actually blocks anyone. Any one of those gaps leaves a side door open, and old leaked passwords are the key.
The good news is that this is a configuration problem, which means it is fixable without buying anything. The tenant you already pay for can be set up to close every one of those doors.