Password spraying is a type of brute-force attack. Instead of trying many passwords on one account, the attacker tries one common password, or a short list, against many accounts. This keeps the number of failed logins per account low, so lockout rules are rarely triggered.

How it works

• The attacker builds a list of usernames from email formats, public staff lists or leaked data.
• They pick passwords that are common but meet typical complexity rules, such as a season plus a year.
• Logins are attempted slowly across many accounts, often against VPNs, webmail and single sign-on portals.
• Any success gives a valid account that can be used for further access.

MITRE ATT&CK describes this as technique T1110.003, a sub-technique of Brute Force.

Why it matters for defenders

Spraying works because some users still choose predictable passwords, and it is hard to see when attempts are spread out. Defenses include blocking common and known-breached passwords, enforcing MFA and watching for many failed logins from one source across many accounts. Leaked username lists also make spraying easier, so knowing which staff emails circulate in breach data helps teams decide where to focus.

Sources: MITRE ATT&CK T1110.003: Password Spraying, MITRE ATT&CK T1110: Brute Force