# How the LSHIY Password-Spraying Attack Abuses OAuth’s ROPC Grant

LSHIY password-sprayed Azure tenants via the deprecated ROPC OAuth grant, minting user tokens that bypassed MFA and Conditional Access, compromising 78 accounts.

- Payout: Real-world hack
- Severity: high
- Program: Microsoft Azure
- Analysis by: Huntress
- Disclosed: 2026-07-22
- Write-up quality: 6/10
- Original: https://www.huntress.com/blog/twist-the-nozzle-on-password-spraying-a-tradecraft-tuesday-recap
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-twist-the-nozzle-on-password-spraying-a-tradecraft-tuesday-recap
- Tags: area:cloud domain:cloud impact:ato impact:mass-exploit kind:incident platform:threat-intel sev:high tech:azure tech:oauth technique:default-creds vuln:auth-bypass vuln:mfa-bypass

**Target:** Azure tenant /token endpoint (ROPC OAuth grant) via Azure CLI
**Root cause:** The deprecated ROPC grant at a tenant's /token endpoint mints a user-delegated token from just username/password, so authentication succeeds without an MFA challenge or Conditional Access evaluation.
**Steps:**
1. Recon: harvest valid usernames from LinkedIn, company sites, breach dumps, phishing.
2. Build a short list of breached/common passwords and company/seasonal variants.
3. Spray one password across all accounts via the ROPC grant at the tenant `/token` endpoint, rotating source IPs (BYOIP IPv6 block `2a0a:d683::/32`) to evade Smart Lockout.
4. On valid credentials, receive a user-delegated token that bypasses MFA and CAP.
5. Pivot to lateral movement, BEC, or exfiltration (or validate creds for resale).
**How found:** Huntress observed a 155x spike in credential spraying, traced to an IPv6 range from LSHIY LLC, and identified ROPC as the flow letting sprays bypass MFA and CAP.
**Exploitation:** Attacker rotated IPs via LSHIY BYOIP IPv6 ranges to spray credentials low-and-slow against Azure CLI/ROPC; correct credentials yielded tokens bypassing MFA/CAP, producing 78 compromises in two weeks. No post-compromise activity observed; creds likely validated for dark-web sale.
**Escalation:** IP rotation across BYOIP/peering providers (LSHIY, FranTech, Tor exits) to evade lockout and detection; MFA scoped to specific users excluded certain groups (like owners tied to ROPC).
**Insight:** Spray against legacy/deprecated OAuth grants (ROPC) and CLI app IDs, not just the web login; MFA scoped to specific users or client app types leaves token endpoints like /token unprotected.