Password spraying

How it works

Standard brute forcing tries many passwords against one account and quickly hits an account lockout policy. Password spraying inverts the approach: the attacker picks a small list of common or seasonal passwords ("Summer2026!", "Password1", a company name plus a year) and tries each one against a large list of usernames, often the whole employee directory pulled from LinkedIn or a breach-derived list. Each individual account sees only one or two attempts, well under any reasonable lockout threshold, so the attack does not trip the defense it was built to avoid. Given a large enough population, a small percentage of users will have chosen one of the sprayed passwords, and that is enough for at least one hit.

Attackers frequently aim spraying at legacy or forgotten accounts first: old test tenants, service accounts, or accounts predating a password policy change, because these are the accounts most likely to sit outside MFA enforcement and outside routine review.

Why it works

Password policies and lockout thresholds are built around single-account brute force, and spraying stays outside the pattern those defenses were designed to catch. The attack also exploits a population-level certainty rather than a single-target guess: with enough usernames, a handful of people will always have picked a weak or predictable password, regardless of how strong the organization's policy looks on paper. The technique is cheap, requires no exploit, and scales to any directory an attacker can enumerate, which is part of why it recurs against organizations that consider themselves otherwise well defended.

How to detect it

• A single source IP or a narrow IP range authenticating against many distinct usernames in a short window, each with only one or two attempts.
• Failed authentication attempts distributed evenly across an unusually large number of accounts rather than concentrated on a few.
• Successful logins on accounts that have not authenticated in months, particularly legacy, test, or service accounts.

Be honest about the limits: shared VPN egress points, campus networks, and some enterprise proxies can produce many logins from one IP as ordinary behavior, so IP concentration alone is not proof. The distinguishing signal is the combination of broad targeting with a low per-account attempt count, which legitimate traffic rarely produces.

How to stop it

• Enforce MFA everywhere with no exceptions, and specifically hunt for accounts excluded from policy, since spraying's favorite targets are the accounts MFA forgot.
• Move to phishing-resistant MFA for privileged and administrative accounts, so a sprayed password alone is never sufficient.
• Ban known-weak and previously breached passwords at creation and reset time rather than relying on complexity rules alone.
• Decommission unused and legacy tenants and accounts; an account nobody remembers is exactly the account without current controls.
• Rate-limit and alert on distributed low-and-slow authentication patterns, not just per-account failure counts.

Seen in the wild

• Midnight Blizzard vs Microsoft: a legacy test account and an over-permissioned OAuth app, where a password spray succeeded against a forgotten test tenant without MFA
• Password spraying

Sources

• MITRE ATT&CK T1110.003: Brute Force: Password Spraying
• OWASP Authentication Cheat Sheet: Password Spraying