In one sentence: Password spraying is when an attacker tries one or two very common passwords against many accounts, instead of many passwords against one account, so they avoid being locked out.

What it is

MITRE ATT&CK describes password spraying (T1110.003) as using a single password, or a small list of commonly used passwords, against many different accounts. It avoids the lockouts that normally happen when someone guesses many passwords against one account.

It is brute force turned sideways: the same weak key tried slowly on every door. It needs no breached list, only the fact that in any group of staff someone chose something predictable.

How it works

1. The attacker collects usernames. Email addresses follow patterns and are easy to find.
2. They choose a few likely passwords. OWASP notes attackers also adjust passwords by common human habits.
3. They try one password across every account, wait, then try the next, staying under lockout limits.
4. They spread the attempts. Microsoft reported an actor using residential proxy networks and a low number of attempts on a limited number of accounts to avoid blocks.
5. A correct guess is a valid login. MITRE notes common targets are exposed services such as Microsoft 365 email, single sign-on, VPNs and remote desktop.
6. The attacker reads email and looks for more access.

Who it affects and how badly

Any organisation with internet-facing logins: Microsoft 365, Google Workspace, VPNs or remote access. Weak passwords and accounts without MFA raise the odds.

10 to 50 staff, such as accountancy, legal, recruitment and estate agencies, often have shared or old accounts without MFA. Schools and charities have many accounts and high turnover. Manufacturers and councils run VPNs and legacy systems. Regulated firms add fines and breach reporting if mailboxes with personal data are opened.

Worst case: one guess leads to mailbox access, then fraud or data theft. In Microsoft’s case the way in was a forgotten test account.

Real examples

Microsoft, January 2024. Microsoft says that from late November 2023 a state-sponsored actor, Midnight Blizzard, used a password spray to compromise a legacy, non-production test tenant account that did not have MFA. The account’s permissions were then used to reach a very small percentage of corporate email accounts, including senior leaders and security and legal staff, and to exfiltrate some emails and documents. Sources: https://www.microsoft.com/en-us/msrc/blog/2024/01/microsoft-actions-following-attack-by-nation-state-actor-midnight-blizzard and https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/

How to detect it

• Look for many failed sign-ins across many accounts with the same few passwords in a short window. MITRE’s detection guidance describes this pattern, using Windows event IDs 4625 and 4771.
• Do not rely on lockouts. MITRE notes attackers may throttle attempts and use LDAP or Kerberos, which avoid common events.
• In Entra ID, review sign-in logs for failures across users and use ID Protection’s password spray detection where licensed. In Google Workspace, review login audit logs.
• Alert on a successful sign-in from a new country or proxy after a run of failures.
• Find old test, shared and leaver accounts without MFA.

How to fix or prevent it

1. Require MFA on every account, including test, shared and service accounts. OWASP calls MFA by far the best defence.
2. Block weak passwords with Entra Password Protection or equivalent, and check new passwords against breached lists.
3. Use Conditional Access to block legacy protocols and unexpected countries.
4. Remove old test apps, unused accounts and leaver accounts.
5. Set lockout thresholds carefully so real users are not locked out.
6. Alert on spray patterns and reset passwords for targeted accounts.
7. Check staff credentials against known breaches and replace reused passwords.

Related terms

• credential stuffing
• brute force attack
• multi-factor authentication
• phishing-resistant MFA
• secret rotation
• indicators of compromise

Browse all entries in the credentials and exposure hub.

FAQ

How is it different from brute force? Brute force tries many passwords on one account. Spraying tries a few passwords across many accounts.

Does MFA stop it? OWASP calls MFA by far the best defence against password attacks.

Has it hit a big company? Yes. Microsoft confirmed in 2024 that a spray against a legacy test account without MFA gave attackers a foothold.

How Wolfcore helps

Breachy checks whether your staff email addresses and passwords are already in known breaches and gives you the exact steps to close each exposure. See Breachy.