Password Spraying
Password spraying is an attack in which someone tries the same few, commonly used passwords against a very large number of user accounts. Because only one or two attempts occur per account, no account gets locked out and the attack goes unnoticed for a long time.
Many people choose surprisingly similar passwords. “Summer2024!” or “Welcome123” are almost guaranteed to show up multiple times in large companies. Password spraying exploits exactly that. The attacker doesn’t take one account and try a thousand passwords, but instead takes a single popular password and tries it against thousands of usernames. Statistically, one hit is enough to get into an organization’s system. The name describes the approach quite well: the password is sprayed broadly across all accounts, like from a spray bottle.
Why account lockouts don’t help here
Almost every login system has protection against brute-force guessing. After three or five incorrect entries, the account is temporarily locked. But this protection counts per account, not per attacker. Anyone who tests only two passwords each against ten thousand accounts never triggers this lockout. The classic protective mechanism therefore misses its mark entirely.
On top of that, the attempts get lost among the mass of normal logins. A large company logs hundreds of thousands of logins daily, including many typos. Two failed attempts for Mrs. Miller look completely unremarkable. Only when you look at all the failed attempts together does the pattern emerge: always the same password, always new names. That is precisely why such attacks often remain undetected for weeks.
The damage is rarely limited to the single account. A valid login is usually just the entry point. From there, the attacker reads internal address lists, sends convincing emails to colleagues, or searches for accounts with more privileges. Security agencies such as Germany’s BSI therefore count password spraying among the most common starting points for larger breaches of corporate networks.
How a spray attack unfolds
First, the attacker needs usernames. These don’t have to be stolen, since many companies build them according to a fixed scheme: firstname.lastname@company.com. Anyone looking at a company’s employee profiles on a career network can generate a list of thousands of plausible identifiers from that. This preparation is completely legal and leaves no trace in the target system.
Next, they choose the passwords. The basis is lists of the most common passwords from past data breaches, combined with whatever password rules enforce. If a company requires uppercase letters, a number, and a special character, very predictable results emerge, such as “Spring2025!”. The company name is often worked in as well. Attackers also prefer access points without extra verification, such as old interfaces or email protocols that lack a second confirmation step.
The actual run is deliberately slow. There are pauses between attempts, and the requests come from changing networks and across different countries. After one round, the attacker sometimes waits days before trying the next password. This should be distinguished from credential stuffing: there, real passwords from data breaches are used, hoping that users reuse them elsewhere. Password spraying, by contrast, works with guessed classics.
From official warnings to your own login
In the news, the term usually appears in connection with attacks on companies, government agencies, or cloud services. In 2024, Microsoft had to admit that attackers used password spraying to get into an old test account without a second verification step, and from there read emails belonging to company leadership. Similar warnings were issued for network access points that let employees connect to the corporate network from outside. Such reports affect stock prices and trust, not just the IT department.
The most effective protection is a second factor during login, such as a code from an app or a security key. Even a correctly guessed password isn’t enough then. Companies also check whether new passwords appear on known leak lists, and evaluate failed attempts across all accounts together. Passwordless methods such as passkeys remove the basis for this attack entirely.
On a personal level, you encounter this principle with your own email account or gaming account. A unique, long password for each service makes you practically unreachable for such an attack, because yours isn’t on the list of classics. A password manager takes care of remembering it. And if login attempts from foreign countries are suddenly reported, that is often the tail end of such a spray wave.