Password Spraying: How the Attack Works, Detection and Defense (2026)

Password spraying is an attack in which someone tries one common password, or a short list of them, against many accounts at once, so that no single account collects enough failed sign-ins to lock. It needs no malware and no vulnerability, only a list of usernames and a sign-in page that accepts a password. Microsoft's Digital Defense Report 2025 counts more than 97% of identity attacks as password spray or brute force, and the technique keeps producing dated cases: between 10 and 14 October 2026, Microsoft Threat Intelligence recorded more than 151,000 failed sign-ins against 327 accounts in eight organizations, peaking at 2,900 failures a minute, from infrastructure it attributes to Storm-0940, an actor it describes as China-state aligned.

This guide explains how the attack works in plain terms, what Microsoft, CISA and others have reported from 2023 to 2026, how an external network or identity penetration test checks your exposure with written permission, which log signals detect a spray and which fixes stop one. It describes the attack at the level a defender or a buyer of testing needs. It does not include attack commands or tool instructions.

Password spraying at a glance

How a password spraying attack works

A spray needs three things, and none of them is hard to get.

A list of usernames. Most organizations use one email format, so a staff list from public sources turns into a username list. Leaked data fills the gaps: Microsoft's 2025 report describes a May 2025 comparison with the Have I Been Pwned database in which 85% of the usernames targeted in spray attacks appeared in known credential leaks. Some sign-in pages also confirm whether an account exists. In a red team assessment CISA published on 21 November 2024, the assessed organization's Microsoft 365 configuration let an unauthenticated outsider validate email addresses by comparing the responses the service returned.

A short list of likely passwords. The attacker is not guessing randomly. The list holds the passwords people choose when a policy forces a capital letter, a digit and a symbol: a season and a year, the company name with a number, a keyboard pattern. A joint advisory from the FBI, CISA, the NSA and Canadian and Australian agencies tells organizations to avoid common passwords and gives "Spring2024" and "Password123!" as examples. NIST makes the same point in SP 800-63B: a user who would have picked "password" picks "Password1!" when composition rules demand it.

A sign-in endpoint that accepts a password on its own. That can be a cloud identity provider, a VPN portal, a remote desktop gateway, a webmail page or an old mail protocol that nobody turned off. Anything that answers "wrong password" or "welcome" will do.

The attacker then tries the first password against every account, waits, and tries the second. The pause is what keeps the spray under the lockout policy. Lockout policies count failed sign-ins per account inside a time window: Microsoft's smart lockout locks an Entra ID account after 10 failed attempts by default in the public cloud, and Windows security baselines suggest the same number for the Active Directory lockout threshold. A spray that makes one or two guesses per account per window never reaches that number on any account. As an illustration, one guess a day against 5,000 accounts is 5,000 password guesses a day, and every account's failure counter reads one.

Two more habits keep a spray quiet. The guesses come from many addresses, so no single source looks busy, and they come slowly. Microsoft's report on the network it tracks as CovertNetwork-1658 describes both: historically an average of 8,000 compromised small office and home office routers, with about 20% of them spraying at any given time, and in about 80% of cases only one sign-in attempt per account per day. Microsoft's conclusion is blunt: monitoring for multiple failed sign-in attempts from one IP address or to one account will not detect this activity.

Not every spray is quiet. The October 2026 Storm-0940 campaign was loud: Microsoft says 48 accounts each received more than 1,000 failures, and lockout responses made up nearly 98% of all the activity. Detection has to cover both shapes, the patient one and the noisy one.

Password spraying vs brute force vs credential stuffing

The three are often used as if they meant the same thing. MITRE ATT&CK lists them as separate sub-techniques of Brute Force, and they fail against different controls.

Real campaigns blend them. Microsoft describes the October 2026 campaign as a mix of broad, low-rate account spraying and sustained, high-volume attempts against selected identities. Huntress says the targeting in the wave of spray attacks it tracked in 2026 seemed to be based on how prevalent a password was on compromised password lists. For a defender the label matters less than the question behind it: can one correct password, however the attacker came by it, open an account without a second factor? Our compromised credential statistics cover the stolen-password side of that question.

Evidence from 2023 to 2026

Each row below is password spraying or closely related credential guessing, as described by the organization that reported it, and each date is the date of that publication or, for the Akira advisory, its latest revision.

Microsoft's annual reports give the scale behind the cases. In the Digital Defense Report 2025, which covers July 2024 to June 2025, more than 97% of identity attacks were password spray or brute force, and research and academic environments drew 52% of observed spray attempts. The infrastructure is concentrated: of more than 50,000 autonomous systems (the networks run by individual providers) that carry authentication traffic each day, just 20, or 0.04%, accounted for more than 80% of malicious password spray activity. The executive summary of the 2026 report says password spray attacks are "now standard across both criminal and nation-state playbooks", and adds a detail that matters for internal networks: over half of intrusions lead to follow-on credential theft, and a significant portion lead to internal password spray campaigns.

Where a spray succeeds: the five gaps

A wrong guess costs the attacker nothing. A spray pays off only when a correct guess is enough to get in, and the reported cases show the same five gaps.

An account with no second factor. Midnight Blizzard's way into Microsoft was a legacy test tenant account without MFA. Microsoft wrote that if the same tenant were deployed today, mandatory policy would ensure MFA was enabled. In the Huntress campaign, eight of the 78 compromised accounts had no MFA policy at all, Huntress reported on 9 July 2026.

MFA that does not cover every sign-in path. This is the gap that surprises people. Of the 78 accounts in the Huntress campaign, 55 had active Conditional Access policies requiring MFA, according to the same 9 July post. Some policies were scoped to particular applications, user groups or untrusted locations, so the flow the attacker used was never challenged, and in two cases MFA was in report-only mode, configured but never enforced. That flow was the resource owner password credentials grant, which Microsoft's own documentation warns against because it is incompatible with MFA.

Legacy authentication. Older sign-in methods, such as basic authentication for POP and IMAP, cannot ask for a second factor. Microsoft's Conditional Access guidance still carries a figure from an analysis of Azure AD traffic that Microsoft first published on 12 March 2020: more than 99% of password spray attacks used legacy authentication protocols. That analysis is more than six years old. Microsoft has since removed basic authentication from Exchange Online for POP, IMAP and its other client protocols, with 1 October 2022 as the date for most cloud environments, and its documentation now says basic authentication is disabled in all tenants. Read the figure as the reason those protocols were retired, not as a measure of today's sprays. The 2026 cases in this guide point the same way: the Huntress campaign went through an OAuth password grant, not through POP, IMAP, SMTP or MAPI, the protocols the 2020 post names, and Microsoft's account of the October 2026 spray does not mention legacy protocols. They still matter on servers you run yourself. The October 2026 joint advisory lists ten Exchange interfaces a spraying tool can use and tells defenders to include all of them.

MFA that a tired user will approve. The 2024 advisory on Iranian actors describes push bombing: where push-based MFA was enabled, the actors sent MFA requests to the real user again and again, hoping one would be accepted. Our MFA bypass statistics cover that family of techniques.

Forgotten accounts and endpoints. A legacy test tenant, a guest account, a departed employee's mailbox, an old VPN profile or a webmail page that predates single sign-on. These sit outside the controls applied to everything else, and nobody is watching their logs.

What AI agents change

Microsoft's October 2026 report also shows a state-aligned actor putting an AI agent framework behind this technique. Microsoft says that during a supply chain compromise disclosed by ConnectWise, Storm-0940 used ARTEX, an open-source agentic penetration testing framework, to accelerate scanning and reconnaissance, password spraying and OAuth application abuse at downstream victims.

The spray Microsoft describes in that report failed. Between 10 and 14 October it produced no successful authentication, no token and no directory change. The access that followed came by another route, Microsoft says: stolen credentials for third-party cloud backup applications that customers had already trusted in their tenants. Microsoft's wider point is about time. Automated activity produces a large volume of traffic and log data that may raise alerts, but its speed leaves defenders very little time to respond to them.

Our reading for password spraying is twofold. Running a spray across many tenants at once now takes less operator effort, so being a small or unremarkable target is less protection than it was. And a control that depends on an analyst noticing failed sign-ins and acting before the next step has less time to work. Controls that make a correct guess worthless, such as MFA on every path, do not depend on anyone being fast. Stingrai's analysis of ARTEX and agentic offensive frameworks covers what Google and Microsoft observed and what a test should now include.

How a penetration test checks password spraying exposure

A penetration test treats password spraying as a set of questions about your sign-in surface, not as a tool to run. The method below is what to expect from a competent tester. It leaves out the commands on purpose.

Get permission in writing, with limits. Spraying real accounts can lock out real users, so it is never assumed to be in scope. The rules of engagement name the endpoints, the accounts or groups, the number of passwords, the pace, the testing window and a contact who can stop the test. Where the endpoint belongs to a cloud provider, the provider's rules apply as well. Microsoft's security testing rules of engagement apply equally to the owner of a tenant and to its authorized agents, and prohibit denial-of-service testing and automated testing that generates excessive traffic.

List every sign-in endpoint. The tester builds the inventory an attacker would: the identity provider, VPN and remote desktop gateways, webmail and every Exchange interface, single sign-on portals, administrative consoles and anything left over from a migration. The endpoint nobody listed is the one most likely to lack MFA. Our guide to external penetration testing covers how that discovery is scoped.

Check what each endpoint gives away. Does the sign-in page reveal whether a username exists? Does it accept legacy protocols? Does it apply lockout or rate limiting at all? Network appliances and older applications do not always have either.

Review the policy before guessing anything. With read access to the configuration, the tester checks the lockout threshold and window, the password length and banned-password settings, and which Conditional Access policies apply to which users, applications and client types. Most of the gaps in the previous section are visible on paper.

Run a controlled spray. A small agreed list of passwords, chosen the way an attacker would choose them for this organization, is tried at a pace below the lockout threshold. The purpose is to measure, not to break in: how many accounts fall to a predictable password, and on which endpoint.

Follow each valid password only as far as agreed. When a password is correct, the tester records whether a second factor stopped the sign-in, on every path that accepts that account. A password that is blocked by MFA on the web portal but works over a legacy protocol is the finding that matters most.

Test detection. Agree beforehand whether the security operations team is told. Whether anyone noticed, how long it took and what they did are among the most useful results the test can produce.

Report accounts, not passwords. Affected accounts are listed by name with the endpoint and the missing control. Recovered passwords are sensitive data: they are handled under the engagement's data rules, reset by the client and never printed in the report.

Inside the network the same check runs against Active Directory from an ordinary domain account, usually as part of an internal test or an Active Directory assessment. The tester reads the domain's lockout settings first and paces the check against them, and the result often sits beside Kerberoasting in the report. Our Kerberoasting guide explains that neighboring technique.

CISA's November 2024 red team report shows what a pass looks like in practice. Among the assessed organization's strengths, CISA wrote that its domain password policy neutralized the red team's attempts to crack hashes and spray passwords.

How to detect password spraying

Detection has to be built from sign-in logs, because the built-in alert comes late. Microsoft's Entra ID Protection has a password spray risk detection, but the documentation is explicit that it is only triggered when an attacker successfully validates a user's password, and that unsuccessful spray attempts do not generate a detection. It is also a premium detection that needs Entra ID P2 for full detail. Treat it as an alarm that a password has already been guessed, and build the earlier warning yourself.

The patterns that separate a spray from ordinary mistyped passwords:

• Many accounts, same failure, short period. Count distinct accounts with a bad-password failure per hour, not failures per account.

• One source, many accounts. The 2024 joint advisory on Iranian actors recommends looking for one IP address used for multiple accounts, excluding expected logins.

• Many sources, shared fingerprint. When the addresses rotate, the user agent, the target application or the network owner often does not. Microsoft's playbook lists failures with repetitive attributes among its low-and-slow indicators.

• Directory order. The same playbook lists failures that follow the order of the global address list, a sign that a tool is working down a directory export.

• Regular timing. Automated sprays tend to have a more regular interval between attempts than people do.

• A success after the failures. A successful sign-in from the same source, application or fingerprint as a run of failures is the event to act on first. Huntress's advice from the June 2026 campaign is to prioritize by credential validity, not by spray volume, because volume points at the most-sprayed tenants, not the compromised ones.

• What happens next. New MFA registrations from unfamiliar devices or places, impossible travel and activity in normally dormant accounts are all on the 2024 joint advisory's list.

One threshold on failures per account will miss the quiet sprays described earlier. Sign-in logs need to be kept long enough to see a pattern that takes days to form.

How to prevent password spraying

The fixes below are ordered by how much of the problem each removes.

1. Require phishing-resistant MFA on every sign-in path. Microsoft's research puts MFA at blocking more than 99.2% of account compromise attacks, and the 2024 joint advisory recommends phishing-resistant methods. Coverage is the part that fails: apply the policy to all users, all applications and all client types, and move report-only policies to enforcement.

2. Block legacy authentication and password-only flows. Block legacy authentication in Conditional Access, turn off basic authentication on the mail servers, gateways and applications you run yourself, and block the resource owner password credentials grant for users. On Exchange servers, account for every interface the October 2026 advisory lists.

3. Ban the passwords attackers try first. Entra ID applies a global banned-password list to every tenant, and a custom list of up to 1,000 terms can add your organization and product names. It is checked when a password is changed or reset, so existing weak passwords remain until then. Extending it to on-premises Active Directory means installing the agent on every domain controller.

4. Prefer length to complexity rules. NIST SP 800-63B, in the revision published in July 2025, requires a minimum of 15 characters for a password used as the only factor and eight when it is part of MFA, requires checking new passwords against a blocklist, and says verifiers shall not impose composition rules or periodic changes.

5. Keep lockout and rate limiting on, on every endpoint. Smart lockout is always on in Entra ID. NIST caps consecutive failed attempts on one account at no more than 100. Check that VPN gateways, remote desktop gateways and older applications have an equivalent, and that AD FS uses extranet lockout.

6. Reduce the endpoints. Put remote access behind the identity provider, retire portals left over from migrations, and close test tenants.

7. Remove stale and unusual accounts. Disable accounts for departing staff, review guest accounts, and look at accounts excluded from MFA policies. The 2024 joint advisory also asks organizations to review help desk practices for initial and reset passwords.

8. Reset what was sprayed. Microsoft's guidance is to reset the password of any account targeted in a spray, and to investigate further where a targeted account held system-level permissions.

9. Plan to remove the password. Passkeys and other passwordless methods leave nothing to spray. Our password statistics track how far that adoption has got.

Why lockout alone is not enough

Lockout does not stop a spray on its own. It counts failed attempts per account, and a spray is designed to stay under that count on every account. Lockout still matters, because it stops the noisier attempts and slows the rest. It also carries a cost: Microsoft's guidance on the lockout threshold notes that an attacker who exceeds it deliberately can lock every account in the organization. Smart lockout reduces that risk by keeping separate counters for familiar and unfamiliar locations.

What MFA does and does not stop

MFA stops the sign-in, on the paths where it is enforced. It does not stop the attacker learning that the password is correct, and a correct password remains useful against any path without MFA, against any other service where the user reused it, and for push bombing. When a spray finds a valid password on an account protected by MFA, the fix is still to change the password.

Where password spraying fits in a penetration test

Four kinds of engagement touch it, and they answer different questions.

Questions worth putting to any provider before the work starts:

• Is password spraying in scope, and against which endpoints and accounts?

• How is the password list chosen, and how many passwords will be tried?

• How will lockouts be avoided, and who can stop the test?

• Will MFA coverage be checked per sign-in path, including legacy protocols and non-interactive flows?

• How are recovered passwords stored, reported and destroyed?

• Is detection in scope, and will the security operations team be told beforehand?

• Is a retest of the fixed accounts and policies included?

For how these tests are packaged and compared, see the guide to network penetration testing and the guide to scoping Azure and Entra ID testing. Remote access without phishing-resistant MFA is also item two in our top 10 network security vulnerabilities for 2026.

Where Stingrai fits

Stingrai is a CREST-accredited penetration testing company offering fully human-led and hybrid (human penetration testers plus AI agents) penetration tests, delivered by experienced penetration testers who are also world-class security researchers and bug bounty hunters. It was founded in Toronto, Canada in 2021 and works with companies from startups to enterprises.

Network and identity work is human-led. In an external network penetration test, Stingrai's penetration testers map internet-facing hosts and forgotten assets, then test VPN, remote access and edge appliances, mail and exposed management interfaces, along with password policy, credential reuse and default or shared credentials. Any password spraying is agreed in the rules of engagement first, with the accounts, the pace and a stop contact named.

• Who does the work: two named penetration testers from a team holding OSCE³, OSWE, OSEP, CREST CRT and CISSP certifications, with 18 published CVEs across the team.

• Where the identity provider is in scope: the cloud penetration test covers Entra ID, including Conditional Access gaps, application registrations, service principals and consent grants, and the Active Directory security assessment covers the on-premises directory.

• How findings arrive: each confirmed finding is posted to the PTaaS platform as it is confirmed, with remediation guidance, so an account without MFA does not wait for the final report.

• What happens after: retesting of fixed findings is included, and the report gives your auditors penetration testing evidence for SOC 2, ISO 27001 and PCI DSS programs.

Engagements run as one-time annual tests or as continuous programs. Network, cloud, Active Directory and red team work is scoped per engagement; Stingrai's published fixed prices cover one web application and associated APIs only (pricing).

Password spraying defender checklist

• List every internet-facing sign-in endpoint, including VPN, remote desktop, webmail, every Exchange interface and anything left from a migration.

• Require MFA for all users, all applications and all client types, and move report-only policies to enforcement.

• Use phishing-resistant methods for administrators first, then for everyone.

• Block legacy authentication, and block the resource owner password credentials flow for users.

• Add your organization, product and location names to the custom banned-password list, and deploy password protection to every domain controller.

• Set a minimum password length in line with NIST SP 800-63B and remove composition and periodic-change rules.

• Confirm lockout or rate limiting on every endpoint, including appliances.

• Disable stale accounts, review guest accounts and close unused test tenants.

• Send identity provider, domain controller, AD FS and VPN authentication logs to the SIEM.

• Alert on bad-password failures across many accounts, and on a success that follows them from the same source or fingerprint.

• Reset the password of every account targeted in a spray, and review MFA registrations on any account where the password was correct.

• Have the result checked in your next external, cloud or internal test, detection included.

Frequently Asked Questions

What is password spraying?

Password spraying is an attack in which one common password, or a short list of them, is tried against many accounts, so that no single account collects enough failed sign-ins to trigger a lockout. MITRE ATT&CK tracks it as technique T1110.003. It needs no malware and no vulnerability, only usernames and a sign-in endpoint that accepts a password.

How does a password spraying attack work?

The attacker collects usernames, usually from the organization's email format, public sources and leaked data, and picks a few passwords people commonly choose, such as a season and a year or the company name with a number. Each password is tried once against every account, with a pause before the next one so that failure counters stay below the lockout threshold. Any account that accepts a password is then used to sign in wherever a second factor is not required.

What is the difference between password spraying and brute force?

A brute force attack against one account tries many passwords for a single username, which lockout and rate limiting stop quickly. Password spraying turns that around: a few passwords against many usernames, so each account sees only one or two failures. Credential stuffing is a third technique, in which username and password pairs stolen from other services are replayed in the hope that the user reused the password.

Is password spraying still used in 2026?

Yes. Microsoft recorded more than 151,000 failed sign-ins against 327 accounts in eight organizations between 10 and 14 October 2026 from infrastructure it attributes to Storm-0940, a joint advisory from the FBI, CISA, the NSA and partner agencies on 8 October 2026 describes Chinese government-linked actors spraying Microsoft Exchange accounts, and Huntress counted more than 81 million attempts that compromised at least 78 accounts in 64 organizations in June 2026.

Does MFA stop password spraying?

MFA stops the sign-in on every path where it is enforced, and Microsoft's research puts it at blocking more than 99.2% of account compromise attacks. It fails where coverage has gaps. In the June 2026 campaign Huntress tracked, 55 of the 78 compromised accounts had Conditional Access policies requiring MFA that did not stop the sign-in the attacker made. A password guessed in a spray should still be changed, because it remains valid on any path without MFA.

Does account lockout stop password spraying?

Not on its own. Lockout counts failed attempts per account, and a spray is paced to stay under that count on every account. Microsoft observed one network of compromised routers making only one sign-in attempt per account per day in about 80% of cases. Lockout still stops noisier attempts, so keep it on and add MFA, a banned-password list and monitoring across accounts.

How do you detect password spraying?

Look across accounts, not at one account. The signals are the same bad-password failure on many accounts in a short period (Entra ID error 50126, Windows events 4771 and 4776), lockouts (error 50053), one source or one fingerprint touching many accounts, failures that follow the order of the address list, and above all a successful sign-in that follows the failures. Microsoft's built-in password spray detection in Entra ID Protection is only triggered after a password has been guessed, so it cannot be the only alert.

How do you prevent password spraying?

Require phishing-resistant MFA for every user, application and client type; block legacy authentication and password-only flows; use a banned-password list with your own organization's terms; set a long minimum length without composition rules, as NIST SP 800-63B requires; keep lockout and rate limiting on every endpoint; remove stale accounts and unused sign-in endpoints; and reset the password of any account targeted in a spray.

Does a penetration test include password spraying?

Only when it is agreed in writing, because spraying real accounts can lock out users. An external network or identity penetration test lists every sign-in endpoint, reviews the lockout and password policy, checks MFA coverage on each path, runs a controlled spray with an agreed list of passwords at a pace below the lockout threshold, and records whether the security team detected it. An internal test or Active Directory assessment runs the same check against domain accounts.

Related reading

• Top 10 Network Security Vulnerabilities to Watch in 2026

• External Penetration Testing (2026): What an External Pen Test Covers, Scope and Cost

• MFA Bypass and AiTM Statistics 2026: Session Hijacking, Phishing and Token Theft

• Compromised Credential Statistics 2026: Stealer Logs, ATO, and Credential Stuffing

• ARTEX and Agentic Offensive Frameworks: What Google Observed and What to Test (2026)

• Kerberoasting Explained: How the Attack Works, Detection and Fixes (2026)

• Azure Penetration Testing: How to Scope Azure and Entra ID (2026)

• Microsoft Entra Conditional Access Validation Matrix: SCuBA Checks and Test Evidence

• Evil Twin Attack: How Fake Wi-Fi Works, Detection and Fixes (2026)

• Lateral Movement Explained: Attack Paths, Detection and Testing (2026)

• Internal Penetration Testing (2026): Scope, Delivery, Cost Drivers and Requirements

Talk to Stingrai

Want to know which of your sign-in endpoints would give way to a predictable password, and whether your team would see the attempt? Stingrai scopes external network, cloud and Active Directory tests with a retest, as a one-time annual engagement or a continuous program. Get a quote.