What is Password Spraying?

Most account lockout policies count failed attempts per account, for example locking after five failures in thirty minutes. A traditional brute force against one account trips that counter quickly. Password spraying is designed specifically to stay under it: an attacker picks a small set of predictable passwords, seasonal patterns like Winter2026! or Summer2026#, or simple defaults like Password1 or Welcome123, and tries exactly one of them against every account in a harvested username list, then waits out the lockout window before trying the next password across the same list. Because each individual account only sees one or two failed attempts in a given window, the attack can run for days without tripping per-account thresholds.

Attackers commonly target internet-facing authentication surfaces that either lack strong lockout policies or are attractive because a single successful hit grants broad access: Microsoft 365 and other federated SSO endpoints, VPN gateways, and RDP portals are frequent targets. Tools like Kerbrute exploit Kerberos pre-authentication behavior to test usernames and passwords against Active Directory without generating the same telemetry as a standard LDAP bind attempt, while frameworks like CrackMapExec support spraying across SMB and other protocols in hybrid Windows environments. Username lists are often built cheaply from LinkedIn scraping or breach data, since most organizations follow a predictable email or login naming convention.

Defense centers on making the spray pattern itself detectable and the passwords themselves harder to guess. Banned-password lists that block common and previously breached passwords at set time reduce how many accounts a given guess actually lands on. Multi-factor authentication neutralizes a successful password guess outright. Identity platforms with adaptive protection, such as Azure AD Identity Protection's risky sign-in detection, specifically model the low-and-slow, many-accounts-one-password pattern rather than relying on simple per-account thresholds, since that per-account view is exactly what the technique is built to slip past.