Huntress observed more than 81 million Microsoft 365 login attempts and 78 compromised accounts across 64 organizations between June 12 and 26, 2026. Attackers used valid credentials with the ROPC flow, which is incompatible with MFA. To reduce this risk, SMBs should inventory ROPC use, check access policies, and replace exposed or reused passwords.
What Huntress observed
Between June 12 and June 26, 2026, Huntress observed more than 81 million login attempts against Microsoft 365 environments. The campaign compromised 78 accounts across 64 organizations. For an SMB, the most important number is not the volume. It is the fact that an exposed password can still open a door.
The attackers targeted Azure CLI, used to administer Azure and Entra resources. They also used the OAuth Resource Owner Password Credentials (ROPC) flow, which sends the password directly to the identity provider. Microsoft advises against ROPC and says it supports neither MFA nor Conditional Access. Huntress found affected organizations with no MFA policy, policies limited to certain accounts or services, or policies left in report-only mode. This was not a Microsoft 365 product flaw: ROPC itself is an authentication path that does not support those controls.
After Huntress reported the abuse, the provider suspended the service associated with the original IPv6 range, and attacks from that range stopped. However, the activity did not end. In a July 15 update, Huntress reported that attempts had shifted to FranTech and then 3xK Tech, using changing infrastructure. Stopping one IP range is therefore not enough to conclude a password-spraying campaign is over: teams should also track the relevant sign-in activity and authentication flows.
Password spraying in plain English
In a classic brute-force attack, an attacker tries many passwords against one account, which can trigger a lockout. With password spraying, the attacker tries one common password across many accounts, then changes the password. The activity is harder to spot and often relies on username-password pairs collected from earlier breaches.
The Huntress campaign highlights two realities: automation can operate at enormous scale, and only a handful of successful logins are needed to create an incident. A mailbox, administrator account, or finance login can then support fraud, internal phishing, or further credential theft.
Why MFA did not cover every path
MFA remains essential for sign-in methods that support it. ROPC is incompatible with MFA and Conditional Access, so do not rely on those policies to protect an application using this flow. Huntress also found policies that were absent, limited to selected groups, applications or locations, or left in report-only mode. Inventory the applications and authentication methods in use, disable ROPC when it is not essential, then verify that MFA and Conditional Access are enforced for other compatible flows.
For an SMB, the useful questions are practical: which accounts still exist, which applications can sign in, which methods are enabled, and what happens when an employee reuses a password that has already leaked?
The role of unique passwords
MFA does not replace good credential hygiene. Every important service should have a different, long, randomly generated secret. That way, compromising one account does not automatically provide the key to another service.
Password reuse increases the impact of a stolen credential. A distinct secret for each service prevents a pair found in one breach from automatically opening other accounts. Teams can use the password generator and the guide to strong, unique passwords.
Three checks to make in your tenant
- Inventory active Microsoft 365 accounts, administrator roles, and shared mailboxes.
- Identify applications using ROPC and disable it when it is not essential; this flow supports neither MFA nor Conditional Access.
- Review successful sign-ins, replace exposed or reused passwords, and revoke sessions for suspicious accounts.
For consistent rules in a small organization, see the SMB password policy guide.
How Soclyde fits
Soclyde helps generate and store unique secrets in local-first vaults that remain on users’ devices. It does not secure a Microsoft 365 tenant by itself or replace MFA and sign-in monitoring. It does reduce reuse without concentrating sensitive credentials in a centralized cloud vault.
Takeaway
The 81 million attempts do not indicate a general flaw in Microsoft 365. They show that a reused password and an improperly controlled ROPC flow can be enough to compromise accounts. Review authentication methods and follow the steps in the SMB password policy guide alongside MFA.
