Password Spraying
Trying a few common passwords across many accounts to avoid lockouts. Effective against weak password policies and accounts without MFA.
Spraying is designed to stay under lockout thresholds, so per-account controls do not see it and only population-level detection does: a small number of failures across a large number of accounts from a narrow set of sources. It remains effective because a predictable seasonal password still works somewhere in any organization above a few thousand people. Banning common and breached passwords does more than complexity rules.
See also: credential stuffing, account takeover, MFA, what is ITDR
Related on Start with Identity
- GlossaryInfostealer
Malware that harvests credentials, cookies, and session tokens from infected devices, then sells them. A major driver of recent account-takeover and session-the
- GlossaryLateral Movement
How an attacker moves from an initial foothold to other systems and accounts, often abusing identity and trust relationships. A primary target of identity threa
- GlossaryMFA Fatigue
MFA fatigue, also called push bombing, is an attack in which someone who already has a user's password triggers push approval prompts over and over until the us
- BlogEntra ID stops delivering SMS and voice codes on February 1, and global admins go last
From February 1, 2027, Microsoft stops providing SMS and voice authentication in Entra ID, and users with no other method must register a passkey to keep signin
- CVEOkta Verify for Windows local privilege escalation
Okta Verify on Windows could be turned into a local privilege escalation. The MFA app on the endpoint is part of the identity plane. Pair with Okta's 2024 FastP
- BlogThe SMS off-ramp has a date now: what Entra, GOV.UK and America.gov mean for your MFA plan
Microsoft stops delivering SMS and voice codes in Entra ID on February 1, 2027. The UK has opened passkeys to more than 23 million GOV.UK One Login users, and t