Attack Defense

🔓 Password Spraying Attacks: How They Work and How to Defend Yourself in 2026

By AY Tanoli · 13 Sep 2026 · 7 min read

CISA's 2024 advisory identified password spraying as one of the top three initial-access techniques used by nation-state actors — including attacks that compromised cloud email accounts across multiple U.S. agencies without triggering a single lockout alert. To protect yourself, the fix is concrete: stop using any password that appears in a "most common" list, and enable multi-factor authentication on every account that matters.

Why Password Spraying Is More Dangerous Than Brute Force

Traditional brute-force attacks are loud. They hammer a single account with thousands of guesses per minute until they hit the lockout wall or find the right password. Most security systems — and most people — are configured to defend against exactly that threat: lock the account after five failed attempts, alert the security team, done.

Password spraying inverts the approach entirely. Instead of many passwords against one account, it uses one password against many accounts. By staying within the lockout threshold for each individual account (usually one or two attempts, then moving on), the attack blends into normal failed-login noise. No account locks. No alert fires. The attacker simply harvests whichever accounts happened to use that one common password.

According to NIST SP 800-63B: "Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) for memorized secrets. Verifiers SHOULD offer guidance to the subscriber, such as a password-strength meter, that assists the user in choosing a strong memorized secret." Organizations that enforce complexity without length tend to push users toward predictable patterns — the exact passwords sprayers rely on.

How a Password Spraying Attack Works: Step by Step

Understanding the mechanics helps you recognize what makes your accounts a harder target.

1. Reconnaissance: The attacker collects a list of valid usernames or email addresses for the target organization or service. These come from LinkedIn scrapes, data breach dumps, or company directories. Even a public "staff" page hands over most of what an attacker needs.
2. Wordlist selection: The attacker picks a short list of high-probability passwords. Common choices are seasonal variations (Autumn2026!), company-name derivatives (Acme@2026), or passwords from the NCSC and HaveIBeenPwned "top 100,000 breached" lists.
3. Slow-and-low spraying: The tool submits one login attempt per account, waiting several minutes between rounds to avoid velocity-detection. Against a company with 2,000 employees, even a 1% success rate yields 20 compromised accounts — often enough to reach a privileged user.
4. Foothold establishment: Once one account is broken, the attacker pivots: reading emails for internal process details, escalating privileges, or using that account to launch a more targeted phishing campaign against executives.

Who Is Most at Risk

Password spraying is not limited to enterprise targets. Any service with publicly discoverable usernames (email addresses, social media handles) and a predictable password-reset culture is vulnerable. The highest-risk scenarios are:

• Corporate Microsoft 365 and Google Workspace accounts — usernames follow a known format, and many organizations still permit legacy authentication protocols that bypass MFA.
• Remote access portals (VPN, Citrix, RDP): These are internet-facing by design, username formats are guessable, and they often lack the same MFA enforcement as primary SSO.
• Personal email accounts used for password resets — if your Gmail is compromised, every "forgot password" email comes to the attacker.
• High-value consumer platforms (banking, crypto exchanges, PayPal) where the prize per account justifies the effort.

The Password Characteristics Sprayers Exploit

Attackers do not pick random passwords for their wordlists — they use statistically dominant patterns derived from billions of leaked credentials. The table below shows the patterns that appear most often in spraying campaigns:

The UK's National Cyber Security Centre (NCSC) has stated: "Attackers use the top 100,000 passwords from breach data. If your password is not in that list, a spray attack almost certainly cannot touch you — so the single most effective defense is using a unique, randomly generated password for every account."

How to Defend Yourself Against Password Spraying

1. Use a unique, randomly generated password for every account

This is the decisive defense. If your password for any given account is genuinely random — a 16+ character string that has never appeared in any breach corpus — no spray wordlist will ever contain it. The attacker's attempt will fail on the first try, every time, regardless of how many accounts they target.

The practical challenge is remembering dozens of unique random passwords. That is exactly the problem a password manager solves. NordPass generates cryptographically random passwords, stores them in a zero-knowledge encrypted vault, and autofills them so you never have to know (or type) any of them. One strong master password protects everything else.

2. Enable multi-factor authentication on every account that matters

MFA does not prevent a sprayer from guessing your password — but it means a correct guess is not enough to break in. Even if an attacker hits your account in a spray, they still need a one-time code from your phone or hardware key to proceed. For high-value accounts (email, banking, work), use a TOTP app or a hardware security key. Avoid SMS-based MFA where possible, as SIM-swapping can bypass it.

3. Check your email against breach databases

Services like Have I Been Pwned let you check whether your email address has appeared in a breach. If it has, the associated password is almost certainly on spraying wordlists. Change it immediately — and change it to something genuinely random, not just a variation on the breached one.

4. Eliminate password patterns in your organization (for IT and security teams)

If you manage accounts for others, the most impactful policy changes are:

• Block known-bad passwords at the point of creation — compare new passwords against a deny list of the top 100,000 breached credentials (NIST SP 800-63B explicitly recommends this).
• Disable legacy authentication protocols (NTLM, Basic Auth, POP3/IMAP without OAuth) that cannot enforce MFA.
• Enable anomaly-detection alerts for distributed failed-login patterns — many attempts from different IPs, each below the lockout threshold.
• Enforce MFA for all remote access, with no exceptions for "service accounts" or legacy systems that claim they cannot support it.

5. Use a different email address for high-value accounts

If attackers do not know which email address you use for your bank, they cannot include you in a targeted spray. Consider using a dedicated alias for financial accounts, separate from your publicly visible email. Many password managers, including NordPass, can generate email aliases for exactly this purpose.

What Makes a Password Spray-Proof

A password that defeats spraying has two properties: it is unique (not shared with any other account) and it is not in any breach corpus (genuinely random, not derived from a human-readable pattern). Length compounds both: a 20-character random string occupies an effectively infinite search space.

CISA's guidance in its 2024 "Secure by Design" advisory puts it plainly: "The most effective technical control against password spraying is eliminating passwords from the equation entirely through phishing-resistant MFA, but for systems where passwords remain the primary credential, the combination of a random unique password per account and MFA reduces residual risk to near zero."

Use the SecureKeyGen password generator to create a random password right now. Set it to at least 16 characters, include uppercase, lowercase, numbers, and symbols, and save it in your password manager. That single action removes you from the vast majority of spraying wordlists permanently.

Frequently Asked Questions

Is password spraying illegal?

Yes. Attempting to access accounts without authorization violates computer fraud and abuse laws in virtually every jurisdiction, including the U.S. Computer Fraud and Abuse Act (CFAA) and the UK Computer Misuse Act. Security professionals may conduct spraying tests only against systems they are explicitly authorized to test (e.g., during a penetration testing engagement).

Can password spraying bypass MFA?

Not directly. However, some attackers combine spraying with MFA fatigue (push-bombing), where a repeated MFA notification is sent until the user accidentally approves it. Using a FIDO2 hardware key eliminates this risk entirely, as it requires physical presence and is phishing-resistant.

How is password spraying different from credential stuffing?

Credential stuffing uses actual username-and-password pairs stolen from previous breaches — the attacker already knows the password and is testing whether it was reused on another service. Password spraying uses no pre-existing credential pairs; it tries candidate passwords against a target list. Both attacks are defeated by unique passwords per account.

How many attempts does a typical spray use per account?

Sophisticated spraying campaigns typically make one or two attempts per account per day, staying well below common lockout thresholds of five to ten failed attempts. Against a large organization, even one attempt per account against thousands of users can yield results.