What Is Password Spraying?

Definition

Password spraying is a type of brute force attack in which an attacker tries one or a few common passwords, such as "Winter2024!", against many accounts at once, instead of many passwords against one account. By staying under each account's lockout limit, the attacker avoids tripping alarms while hunting for the one user with a weak password.

How It Works

A 2018 alert from the FBI and the Department of Homeland Security (TA18-086A) describes the "low-and-slow" method: the attacker "attempts a single password against many accounts before moving on to attempt a second password, and so on." Typical lockout policies allow "three to five bad attempts" per period, so one guess per account rarely locks anyone out.

The usual steps:

1. Collect usernames from LinkedIn, the company website, or email address patterns.
2. Pick likely passwords: seasons and years, the company name, "Password123!"
3. Spray against a single sign-on (SSO) portal, Microsoft 365, a VPN, or webmail, often from many IP addresses so no single source looks noisy.
4. Use the hit: read email, download the address list, and spray again from inside.

Signs include a burst of failed sign-ins across many accounts, failures for usernames that do not exist, and sign-ins from unusual locations. CISA recommends "looking for multiple, failed authentication attempts across all accounts" rather than watching each account alone.

Multi-factor authentication stops most sprays from turning into access, but only on accounts where it is enforced. Microsoft reported in January 2024 that the Russian group Midnight Blizzard used a spray with "a low number of attempts" to compromise "a legacy, non-production test tenant account that did not have multifactor authentication (MFA) enabled."

Real-World Example

In October 2024, the FBI, CISA, NSA, and international partners warned (advisory AA24-290A) that since October 2023, Iranian actors had used "brute force, such as password spraying," together with MFA push bombing, to break into accounts at healthcare, government, IT, engineering, and energy organizations. In two confirmed compromises, the actors used a victim's open MFA registration to enroll their own device as the second factor. In others, they set up MFA themselves on accounts that had none, locking in their access. The agencies assessed that the actors sold access and network information on cybercriminal forums.

Why It Matters for a Small Business

Password spraying is cheap, automated, and aimed at exactly what most small businesses rely on: a Microsoft 365 or Google Workspace sign-in page open to the internet. The attacker does not need to target you specifically. It only takes one account with a guessable password and no MFA, often a former employee, a shared mailbox, or an account created for a vendor. From there they can read invoices and impersonate staff in payment fraud. Small offices also tend to lack anyone watching for many failed sign-ins spread across accounts, which is exactly the pattern spraying produces.

How to Spot It / How DTS Handles It

Look in your sign-in logs for many accounts failing at the same time, failures on nonexistent usernames, and successful sign-ins from unfamiliar countries or hosting providers soon after a wave of failures.

DTS can help with enforcing MFA on every account, blocking legacy sign-in methods that skip MFA, banning common passwords, disabling unused accounts, and alerting on spray patterns. See our Microsoft 365 security service.

Related Terms

• Brute force attack: the broader family spraying belongs to.
• Credential stuffing: reusing leaked passwords instead of guessing.
• MFA: the control that stops most sprays.
• MFA fatigue: push bombing, used alongside spraying.
• Account takeover: the result of a successful spray.
• Password manager: makes unique, unguessable passwords practical.
• Conditional access: blocks risky sign-ins by location or device.

Sources

• FBI and DHS, Brute Force Attacks Conducted by Cyber Actors, TA18-086A (March 27, 2018, revised May 6, 2020): https://www.cisa.gov/news-events/alerts/2018/03/27/brute-force-attacks-conducted-cyber-actors
• FBI, CISA, NSA and partners, Iranian Cyber Actors' Brute Force and Credential Access Activity Compromises Critical Infrastructure Organizations, AA24-290A (October 16, 2024): https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-290a
• Microsoft Threat Intelligence, Midnight Blizzard: Guidance for responders on nation-state attack (January 25, 2024): https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/

---

Last updated October 14, 2026.