Password Spraying

What it is

Password spraying tries a small number of common passwords across many accounts. It differs from brute-forcing one account with many guesses and from reusing known leaked username-password pairs. By spreading attempts, attackers can exploit predictable passwords while staying below per-account failure thresholds.

How it works

The attacker assembles likely usernames and tests a few popular or organization-themed passwords. Attempts may be slow and distributed over time and network addresses. A monitoring system focused only on many failures for one user can overlook the pattern across the whole organization.

How people get tricked

No immediate social manipulation is required. Users may choose a shared onboarding password or a familiar seasonal pattern that meets complexity rules. An organization can unintentionally encourage predictability through weak default or reset processes.

Example scenario

Dozens of employee accounts each have one failed login within a short period. One succeeds because the user kept a common initial password; individually, most accounts never reach the lockout threshold.

Warning signs

• Similar failed attempts spread across many usernames.
• Failures and a subsequent success from unusual locations or infrastructure.
• Targeting of legacy or remote-access sign-in endpoints.

If it happens to you

Investigate any successful sign-ins associated with the campaign and revoke unauthorized access. Reset compromised or weak credentials and inspect the targeted authentication paths. Tuning only one account's lockout threshold may leave the broader spray strategy effective.