Password spraying in plain English
In a classic brute-force attack, an attacker tries countless passwords against a single account. That quickly attracts attention, because the account is usually locked after a few failed attempts. Password spraying turns this principle around: the attacker takes one obvious password and tries it on every account they know. Then they wait and try the next one.
Picture a thief who doesn’t spend hours rattling a single front door. Instead, he walks down the whole street and briefly tries the handle of every door. Somewhere, someone is bound to have forgotten to lock up.
The attack relies on the fact that people choose similar passwords: the season plus the year and an exclamation point, the company name plus a digit, or an initial password that was assigned during setup and never changed.
How password spraying works
- Collect usernames: The attacker gathers employee names, for example from the company website, professional networking sites, or earlier data breaches. This kind of research using open sources is called OSINT. From the format of the email addresses, the attacker derives the usernames.
- Choose a target: Login pages that are reachable from the internet are attractive targets – cloud services such as Microsoft 365, webmail, VPN portals, or remote access.
- Spray slowly: The attacker tries a password such as “Fall2026!” on all accounts. They deliberately go slowly, often spreading their attempts across many changing IP addresses, so that no lockout kicks in and no alarm goes off.
- Exploit the hits: A single account without additional protection is enough as an entry point – for phishing emails sent from a genuine mailbox, for accessing documents, or as a springboard into the corporate network.
Password spraying differs from the related credential stuffing in that the attacker doesn’t try stolen credentials but bets on weak, predictable passwords.
A practical example
A construction company uses Microsoft 365. New employees receive the password “Welcome1!” when they start and are supposed to change it – but this isn’t enforced. Multi-factor authentication is enabled only for the management team.
An attacker collects employee names from a professional networking site and, over several weeks, tries a few typical passwords. “Welcome1!” works for two accounts belonging to site managers. From one of the mailboxes, the attacker sends invoices with altered bank details to customers – after all, the emails come from a genuine address.
The fraud only comes to light when a customer asks about it. The sign-in logs show the typical trail: many failed logins across many accounts, but only a few attempts per account.
Why does this matter for businesses?
Password spraying requires neither special knowledge nor expensive tools. It affects companies of all sizes, because every account with a weak password and no MFA is a potential way in.
What makes it especially dangerous is that the attack runs quietly. Account lockouts don’t kick in, and isolated failed attempts are easily lost in the logs. Unless you specifically look for this pattern, you often notice the attack only once an account is already being misused.
The consequences range from leaked confidential emails and invoice fraud to an entry point for ransomware – extortion malware. If personal data is affected, notification obligations under the GDPR may also arise.
How to protect your organization
- MFA for all accounts: Multi-factor authentication makes a guessed password worthless on its own – provided there are no exceptions.
- Use banned-password lists: Technically block obvious passwords such as seasons, company names, or “Password123” with a banned-password list.
- Long passphrases: Encourage long passphrases instead of short, formulaic passwords.
- Secure initial passwords: Assign individual initial passwords and enforce a change at first sign-in.
- Close legacy sign-in paths: Protocols that don’t support MFA should be disabled.
- Monitor sign-ins: Watch for many failed attempts across many accounts and for sign-ins from unusual regions.
How Rootsektor can help
With our Microsoft 365 & Azure Review, we check how well your Microsoft cloud is protected against password spraying. We determine whether MFA is enforced everywhere, which password policies and banned-password lists are active in Entra ID (the sign-in service behind Microsoft 365), whether legacy sign-in paths are open, and whether suspicious sign-in patterns are detected. You receive prioritized remediation recommendations; you can request a fixed-price quote after scoping via our Pentest Quote page.