What is Password Spraying?

Password spraying is a password-guessing tactic where the attacker tries one or a few common passwords against many accounts. They stay under per-account lockout thresholds by not hammering the same username repeatedly. It is a horizontal attack: one weak password, thousands of users.

How spraying differs from other attacks

Classic brute force throws many passwords at one account. Credential stuffing reuses leaked pairs from other sites. Spraying picks likely passwords (“SeasonYear”, company name plus digit, default onboarding passwords) and walks the user list once per password, often slowly and from many IPs.

Cloud identity (email, SSO, remote access) is a frequent target because one success yields mailboxes, file shares, and downstream SaaS resets.

Execution pattern

Attackers harvest usernames from directories, prior leaks, or predictable formats. They run automated login attempts with pauses and distributed infrastructure so alarms stay quiet. After hours or days they rotate to the next password in a short list.

Why operations and marketing security teams care

A single compromised mailbox can authorize fraudulent payments, reset ad accounts, or exfiltrate CRM exports. That can increase ad fraud risk through changed billing contacts or malicious tracking. MFA and modern auth policies block most spray successes, but legacy protocols and shared mailboxes still slip through.

Monitoring should correlate many light failures across users. Pair identity hardening with awareness of remote access abuse paths described in VPN and perimeter guides, and with bot-driven login noise. Small businesses are common victims because spray tools scan the whole internet. Brands should inventory which SaaS apps allow legacy IMAP or SMTP logins and disable them where possible.

For related reading on volume attacks, see how to stop bot attacks and tools that centralize auth logging.