What Is Password Spraying and How Do You Stop It?

Zac Tassone

Published 5 June 2025 · Updated 22 October 2026

Password spraying is a simple attack that works surprisingly well against businesses. Instead of trying thousands of passwords on one account, the attacker tries a handful of common passwords across many accounts. It only needs one person in your business to be using “Summer2026!” or your company name followed by a number.

This guide explains how password spraying works, why it is hard to notice, and the practical steps that stop it, particularly if your business runs on Microsoft 365.

How password spraying works

1. Collect usernames. Business email addresses are easy to guess. If your website lists jane.smith@ and your LinkedIn page lists the team, an attacker can build a list of likely logins in minutes.
2. Pick a few likely passwords. Common choices include the season and year, the company name, the suburb, or simple patterns such as “Password1”.
3. Try each password once across every account, then wait before trying the next one.
4. Spread the attempts out over hours or days and across many internet addresses, so no single account or location looks suspicious.

Because each account sees only one or two failed attempts, the usual “lock the account after too many wrong passwords” rule often never triggers.

How it differs from similar attacks

• Brute force tries many passwords against one account. It is noisy and usually triggers lockouts.
• Credential stuffing uses real username and password pairs stolen in other breaches, betting that people reuse passwords.
• Password spraying guesses a few common passwords across many accounts. It is quiet, slow and relies on at least one weak password existing somewhere.

A real example

Password spraying is not only used against small targets. In January 2024 Microsoft reported that a nation-state group it calls Midnight Blizzard used a password spray attack to compromise a legacy, non-production test account that did not have multi-factor authentication (MFA) enabled. Microsoft said the attackers used a low number of attempts to avoid detection and account blocks, and launched them from a spread of residential internet addresses.

The lesson for any business is the account that was hit: an old test account with no MFA that nobody was watching.

Why small businesses are exposed

• Predictable passwords chosen to meet “complexity” rules, such as a capital letter, a number and an exclamation mark on the end.
• Shared or generic accounts such as reception, accounts or admin.
• Accounts left open after staff leave.
• Older sign-in methods that do not support MFA.
• Nobody reviewing sign-in logs.

How to stop password spraying

Turn on MFA for every account

MFA is the single most effective control. Even when a sprayed password is correct, the attacker still cannot sign in. “Every account” includes admin, shared, service and test accounts, which are the ones most often missed. Our small business guide to MFA explains how to roll it out.

Use passphrases and ban common passwords

Long passphrases made of several random words are far harder to guess than short, complex passwords. Block obvious choices like the company name, the season and “Password”. Our guide to strong passwords and authentication covers this in plain English.

Use the protections already in Microsoft 365

Microsoft Entra ID, which sits behind Microsoft 365 sign-ins, has smart lockout switched on by default. In standard tenants it locks an account for a short time after 10 failed attempts, and Microsoft also analyses sign-in signals to block malicious attempts. On top of that, a properly configured tenant should:

• Block older sign-in methods that cannot do MFA.
• Use sign-in rules to block or challenge logins from unexpected countries or unmanaged devices.
• Send alerts for risky sign-ins.

Our Microsoft 365 services include setting these up correctly.

Remove accounts you do not need

Disable accounts on a staff member’s last day, review shared mailboxes, and delete old test or trial accounts. Fewer accounts means fewer targets.

Signs you may be targeted

• Failed sign-ins on many different accounts at around the same time.
• Failed attempts from the same internet address against several users.
• Sign-in attempts on accounts that are rarely used.
• Unexpected MFA prompts reported by staff, which can mean a password has already been guessed.

If you suspect an account has been compromised, reset its password, sign it out of all sessions, check for new mailbox forwarding rules and review recent activity. If you have lost money or data, report it through ReportCyber at cyber.gov.au.

Quick checklist

• MFA on every account, including admin, shared and test accounts.
• Common and company-related passwords blocked.
• Older sign-in methods switched off.
• Leavers disabled on their last day.
• Sign-in alerts going to someone who will act on them.

Password spraying is one of several ways attackers get into business accounts. Read 7 unexpected ways hackers get into business accounts for the others.