What is a password spraying attack?

Password spraying is a distinct type of brute force attack that targets multiple accounts using a single password attempt, rather than repeatedly attempting numerous passwords on a single account. This method is often effective because many users rely on simple, predictable passwords such as “password” or “123456.”

In many organizations, account lockout policies are triggered after a certain number of failed login attempts. However, password spraying circumvents these lockouts by testing one password across numerous accounts, avoiding detection and lockout mechanisms designed for traditional brute force attacks.

Unlike attacks that focus on a single user, password spraying can target millions of accounts simultaneously. The process is typically automated and often executed over an extended period to further evade detection.

These attacks are particularly common in scenarios where applications or administrators assign default passwords to new users. Platforms such as single sign-on (SSO) systems and cloud-based services are also frequent targets due to their centralized access and widespread adoption.

While seemingly straightforward, password spraying remains a favoured technique among even the most advanced cybercriminal groups due to its efficiency and high success rate.

How does a password spraying attack work?

Password spraying attacks typically involve these steps:

Step 1: Cybercriminals purchase a list of usernames or create their own list

To carry out a password spraying attack, cybercriminals often begin by purchasing lists of usernames stolen from various organizations. It is estimated that over 15 billion credentials are currently available for sale on the dark web.

Alternatively, attackers may generate their own lists by identifying common corporate email address formats, such as firstname.lastname@companyname.com, and cross-referencing these with employee information found on platforms like LinkedIn or other publicly available sources.

Cybercriminals frequently target specific employee groups, such as those in finance, administration, or executive leadership (C-suite), as these targeted approaches tend to yield higher success rates. Companies or departments that use single sign-on (SSO) or federated authentication protocols—such as logging into one platform with credentials from another—or those lacking multi-factor authentication (MFA) are particularly vulnerable to such attacks.

Step 2: Cybercriminals obtain a list of common passwords

Password spraying attacks incorporate lists of common or default passwords. It’s relatively straightforward to find out what the most common passwords are – various reports or studies publish them each year, and Wikipedia even has a page which lists the most common 10,000 passwords. Cybercriminals may also do their own research to guess passwords – for example, by using the name of sports teams or prominent landmarks local to a targeted organisation.

Step 3: Cybercriminals try out different username/password combinations

Once cybercriminals have compiled a list of usernames and passwords, their goal is to test these combinations until they find one that works. The process is typically automated using password spraying tools. To bypass lockout policies and IP address blockers that limit repeated login attempts, attackers test one password across multiple usernames before moving on to the next password in their list.

Signs of a password spraying attack

Password spraying attacks often result in a high volume of failed authentication attempts across multiple accounts. Organizations can identify such activity by analysing authentication logs for repeated login failures involving valid accounts on systems and applications.

Overall, the main signs of a password spraying attack are:

• A high volume of login activity within a short period.
• A spike in failed login attempts by active users.
• Logins from non-existent or inactive accounts.

How to defend against password spraying attacks

Organisations can protect themselves from password spraying attacks by following these precautions:

Implement a strong password policy

By enforcing the use of strong passwords, IT teams can minimise the risk of password spraying attacks.

Ensuring strong lockout policies

Setting a suitable threshold for the lockout policy at domain level defends against password spraying. The threshold needs to strike a balance between being low enough to prevent attackers from making multiple authentication attempts within the lockout period, but not so low that legitimate users are locked out of their accounts for simple errors. There should also be a clear process for unlocking and resetting verified account users.

Adopt a zero trust approach

The cornerstone of the zero trust approach is providing access to only what is required at any given time to complete the task at hand. Implementing zero trust within an organisation is a key contribution towards network security.

Use a non-standard username convention

Avoiding selecting obvious usernames like john.doe or jdoe – which are the most common methods for usernames – for anything other than email. Separate non-standard logins for single sign on accounts is one way to evade attackers.

Use biometrics

To prevent attackers from exploiting the potential weaknesses of alphanumeric passwords, some organisations require a biometric login. Without the person present, the attacker can’t log in.

Look out for patterns

Make sure any security measures in place can quickly identify suspicious login patterns, such as a large volume of accounts attempting to log in simultaneously.

Using a password manager can help

Passwords are intended to protect sensitive information from criminals. However, the average user today has so many passwords that it can be difficult to keep track of them all – particularly as each set of credentials is supposed to be unique.

To try to keep track, some users make the mistake of using obvious or easy-to-guess passwords, and often use the same password across multiple accounts. These are precisely the type of passwords that are vulnerable to password spraying attacks.

Attacker capabilities and tools have evolved considerably in recent years. Computers are much faster today at guessing passwords. Attackers use automation to attack password databases or online accounts. They have mastered specific techniques and strategies that yield more success.

For individual users, using a password manager, such as N-Able PassPortal, can help. Password managers combine complexity and length to offer up hard-to-crack passwords. They also eliminate the burden of having to remember different login details and moreover, a password manager will help to check whether there is a repetition of passwords for different services. They are a practical solution for individuals to generate, manage, and store their unique credentials.