Huntress measured a 155× increase in password spraying attacks in the first half of 2026, driven by an LSHIY campaign that generated 81 million login attempts in two weeks through the ROPC flow. Security teams must disable ROPC and extend MFA to every authentication flow, with no exceptions.
An Akira ransomware affiliate got initial access through a SonicWall VPN with no MFA, then rebooted the box into Safe Mode to neutralize EDR while exfiltrating. Huntress’s account shows an EDR is no safety net once an attacker holds valid credentials.
On August 5, 2026, Connor Riley Moucka, 26, pleaded guilty in a US federal court for his role in breaching Snowflake customer accounts. With accomplice John Erin Binns, he exfiltrated terabytes of data from 165 organizations by exploiting absent MFA. The verdict lands two years after the facts — the lesson for cloud teams is unequivocal.
Authentik has become the default identity provider for self-hosters in 2026, surpassing both Authelia and Keycloak. One Docker Compose file, five minutes of configuration, and every service you run shares the same login, the same MFA, and the same user directory.
