Password spraying is a brute force attack with manners: instead of hammering one account with thousands of guesses, the attacker tries a handful of very common passwords — Welcome1, Summer2026!, CompanyName2026 — across many different accounts, staying under each account's lockout limit. It is quiet, it scales across an entire user directory, and it is the technique state-linked attackers have used against real Australian and international organisations. This guide covers how spraying works, why it beats lockout policies, and the controls that stop it.
TL;DR
- Password spraying tries a few common passwords across many accounts instead of many passwords against one.
- It is designed to slip under account lockout rules: one or two attempts per account looks like normal user error.
- Attackers pair it with MFA fatigue: the password is guessed, then approval prompts are spammed.
- MFA everywhere, a custom bad-password blocklist and lockout alerting stop it.
- Cyber Aware's security awareness training covers the password habits that make spraying pointless.
How password spraying works
A normal brute force attack targets one account and dies at the lockout threshold. Spraying inverts it: build a list of thousands of usernames — harvested from LinkedIn, the company website, or a previous breach — and try the same one or two passwords against all of them. Every individual account sees one failed login, which blends into the noise of forgotten passwords. A week later, the attacker sprays a second password.
Sprayed passwords are chosen for human logic, not randomness: the season plus the year (Summer2026), the company name plus digits, a product name exclamation-marked. Staff pick these passwords precisely because they are memorable — which is exactly why they are the first ones sprayed.
Why it works on organisations, not just individuals
| Property | What it means for the attacker |
|---|---|
| One guess per account | Never trips a per-account lockout |
| Thousands of accounts | Even a 1% hit rate yields plenty of access |
| Common-password list | Matches the predictable passwords staff actually use |
| Slow cadence over weeks | Stays below suspicious-failure alerts |
The maths is unflattering: if one staff member in a hundred uses "CompanyName2026!", a 1,000-person directory gives the attacker ten logins per spray. No malware, no phishing email, no exploit — just a login page and a wordlist.
Real campaigns used password spraying
This is not a theoretical technique. A joint advisory from the FBI, CISA, the NSA and ASD's Australian Cyber Security Centre documented Iranian state-linked actors compromising critical infrastructure organisations using password spraying against MFA-protected accounts, followed by push-bombing to defeat the second factor (joint advisory on Iranian brute force activity). ASD's own Essential Eight assessment guidance separately flags that organisations may want to avoid MFA methods most exposed to this kind of social engineering — the spraying and MFA-fatigue combination is documented Australian guidance, not a niche scenario.
The related credential-stuffing attack reuses passwords from other breaches instead of guessing them; the credential stuffing guide covers why staff password reuse feeds it.
How to stop password spraying
- Multi-factor authentication on every external-facing login. A sprayed password without the second factor is worthless. This single control removes most of the payoff.
- Use phishing-resistant MFA where practical. Number matching or FIDO2 keys close the MFA-fatigue route that follows a successful spray.
- Block common passwords at the directory level. Microsoft 365 and Google Workspace can enforce custom blocked-password lists — put the seasonal patterns, the company name and the top breached passwords on it.
- Alert on the spray pattern, not the single failure. One failed login is noise; the same failure across dozens of accounts in an hour is the attack. Configure sign-in logs to catch the pattern.
- Trim the username surface. Standardised firstname.lastname@ addresses are convenient for attackers building their target list; where the directory allows, keep it that way deliberately but monitor it accordingly.
- Retire the seasonal password rotation habit. Forcing Summer2026! to become Winter2026! just manufactures the exact patterns sprayers use. Long passphrases plus a password manager beat rotation.
A security gap assessment shows which of these controls are actually enforced across your systems rather than assumed — most teams find at least one externally-facing login without MFA.
Why this matters for Australian businesses
The Australian Signals Directorate's Annual Cyber Threat Report 2024-25 recorded more than 84,700 cybercrime reports in 2024-25 — one every six minutes — with the average self-reported cost for a small business at $56,600. Commodity attackers spray the entire internet-facing IP space continuously; any business with a webmail or VPN login is in the target list whether or not it has ever been in the news.
The training connection is direct: the passwords that survive spraying are the ones staff choose through policy, not habit. KnowBe4's 2026 Phishing by Industry Benchmarking Report — 67.7 million simulated phishing tests — shows susceptibility falling from 33.2% to 4.2% over twelve months of sustained monthly training; the same cadence is what moves password behaviour off the sprayed list and onto passphrases and managers.
FAQ
What is password spraying in simple terms? Trying the same few common passwords across many accounts — the reverse of guessing many passwords against one account — to stay under lockout limits.
How is password spraying different from brute force? Brute force guesses exhaustively against one account; spraying makes one or two educated guesses against thousands. Spraying is the quiet version built to evade lockouts.
Does an account lockout policy stop spraying? It stops the loud version. Spraying is designed around lockouts — one attempt per account never triggers one — so lockouts alone are not a defence; MFA and bad-password blocking are.
What passwords do spraying attacks try first? Seasonal patterns (Summer2026!), the company or product name with digits, and long-standing favourites from breach dumps. If you can guess what your staff's password is, so can a sprayer.
How would we know we are being sprayed? Sign-in logs showing the same failed password across many different accounts in a short window — usually from a small set of IP addresses. That pattern is the spray signature.
Does MFA fully stop password spraying? It stops the login, which removes the payoff. The documented follow-up is MFA fatigue — spammed approval prompts — so pair MFA with number matching and a trained deny-and-report habit.
One last thing
Spraying succeeds against the one staff member who picked the predictable password, not the organisation as a whole — so the fix is systemic, not individual: MFA everywhere, a blocked-password list, and a password manager so nobody ever has to invent "CompanyName2026!" again.