Password Spraying

Password spraying is a brute-force technique turned sideways. Instead of hammering one account with thousands of password guesses — which triggers account lockout within minutes — the attacker tries one or two very common passwords ("Summer2026!", "Company123") against every account in an organization, then waits and repeats with the next candidate.

How it works

The attack has three quiet ingredients:

• A username list. Corporate email formats are predictable ([email protected]), and staff lists are easy to assemble from LinkedIn and marketing pages. Some login systems also leak which usernames are valid through different error responses.
• A short list of probable passwords. Seasonal patterns, company name variants, and the perennial top-100 passwords. In any sufficiently large workforce, someone is using one of them.
• Patience. By spreading attempts across many accounts and long intervals — often from rotating IP addresses — each individual account sees only a handful of failures, staying below lockout thresholds and off basic monitoring dashboards.

One weak password is all it takes. The compromised mailbox then becomes a platform for internal phishing and business email compromise, sent from a real account that passes every authentication check. Password spraying differs from credential stuffing, which replays known breached passwords; spraying guesses fresh, betting on human predictability rather than past leaks.

How to defend against it

• Ban weak and common passwords at creation. Screen new passwords against breached and common-password lists (per NIST guidance) so "Winter2026!" is never accepted in the first place.
• Enforce MFA everywhere, especially on legacy protocols. Disable legacy authentication (IMAP, SMTP AUTH) that bypasses modern MFA checks — sprayers deliberately target these endpoints.
• Detect the pattern, not the account. Alert on many accounts each failing once from related infrastructure within a window — the spray signature — rather than only on repeated failures per account.
• Address the human layer. Password reuse and predictable patterns are behaviors; measuring and coaching them is part of a human risk score.