Microsoft 365 users and admins, beware! There's a specific IPv6 range (2a0a:d683::/32) operated by a provider called LSHIY that is engaging in password spraying / brute force login attempts against Microsoft accounts with old, previously leaked credentials that were disclosed as part of prior breaches.
The attack bypasses MFA and SSO because it uses the deprecated (but still functional) OAuth Resource Owner Password Credentials 2.0 flow. But it works because some people still use creds that were stolen years ago and were never changed. So change your passwords, people!
https://www.huntress.com/blog/lshiy-password-spray-attack
#M365 #bruteforce #passwordspray #compromise #weakpasswords
Andrew 🌻 Brandt 🐇
npub1nz…8spjz
2026-06-30 20:47:54 UTC
Author Public Key
npub1nzexqulws7nx68zkye7k5wsx3gglvr2us74ljhwl5e8a8ztpawzqz8spjzSeen on
wss://relay.momostr.pinkPublished at
2026-06-30 20:47:54 UTCEvent JSON
{
"id": "2784f11dac77421943dbdc03db791ab72a53e8bb4109a8760edda7d7c1a4b8a8",
"pubkey": "98b26073ee87a66d1c56267d6a3a068a11f60d5c87abf95ddfa64fd38961eb84",
"created_at": 1782852474,
"kind": 1,
"tags": [
[
"t",
"weakpasswords"
],
[
"t",
"passwordspray"
],
[
"t",
"m365"
],
[
"t",
"bruteforce"
],
[
"proxy",
"https://infosec.exchange/@threatresearch/116841019788486991",
"web"
],
[
"t",
"compromise"
],
[
"proxy",
"https://infosec.exchange/users/threatresearch/statuses/116841019788486991",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/threatresearch/statuses/116841019788486991",
"pink.momostr"
],
[
"-"
]
],
"content": "Microsoft 365 users and admins, beware! There's a specific IPv6 range (2a0a:d683::/32) operated by a provider called LSHIY that is engaging in password spraying / brute force login attempts against Microsoft accounts with old, previously leaked credentials that were disclosed as part of prior breaches. \n\nThe attack bypasses MFA and SSO because it uses the deprecated (but still functional) OAuth Resource Owner Password Credentials 2.0 flow. But it works because some people still use creds that were stolen years ago and were never changed. So change your passwords, people!\n\nhttps://www.huntress.com/blog/lshiy-password-spray-attack\n\n#M365 #bruteforce #passwordspray #compromise #weakpasswords",
"sig": "d705fe8c095c08fff11cc22f3d3505f1b12f6d0200f4216fd21a2b234ef89abd074971460b3e7ce5392f2dd896c28a544ae6b844babd268987ffc534eb90685d"
}