Password Spraying
Trying a few common passwords across many accounts to avoid lockouts. Effective against weak password policies and accounts without MFA.
Spraying is designed to stay under lockout thresholds, so per-account controls do not see it and only population-level detection does: a small number of failures across a large number of accounts from a narrow set of sources. It remains effective because a predictable seasonal password still works somewhere in any organization above a few thousand people. Banning common and breached passwords does more than complexity rules.
See also: credential stuffing, account takeover, MFA, what is ITDR
Related on Start with Identity
- GlossaryInfostealer
Malware that harvests credentials, cookies, and session tokens from infected devices, then sells them. A major driver of recent account-takeover and session-the
- GlossaryLateral Movement
How an attacker moves from an initial foothold to other systems and accounts, often abusing identity and trust relationships. A primary target of identity threa
- GlossarySession Hijacking
Stealing a valid session, commonly via a captured session cookie or token, to impersonate a user and bypass MFA. Mitigated by token binding, short lifetimes, an
- CVEOkta Verify for Windows local privilege escalation
Okta Verify on Windows could be turned into a local privilege escalation. The MFA app on the endpoint is part of the identity plane. Pair with Okta's 2024 FastP
- CVEZimbra ZCS chained with CVE-2025-48700 to steal MFA backup codes
Zimbra Collaboration Suite, chained with CVE-2025-48700, was used to steal MFA backup codes and app passwords (CERT-UA UAC-0233). Added to CISA KEV in mid-March
- TechniquePassword spraying
Instead of guessing many passwords against one account and triggering a lockout, the attacker guesses a few common passwords against many accounts, staying unde