LSHIY Password Spray: ROPC and MFA Gaps in Microsoft 365
A June 2026 password spray from LSHIY LLC's IPv6 range compromised 78 Microsoft accounts across 64 organizations by abusing Azure CLI ROPC sign-ins that MFA policies did not cover.
MFA Bypass
1 article