Password spraying

Description

The passwords chosen are the ones people actually use — "Summer2026!", the company name and the year, the device default nobody changed — and the whole list of accounts is targeted. The list of usernames is easy to assemble from public sources, and it usually comes down to one pattern (first.last).

Because spraying is slow and stays out of sight, it never trips the thresholds that watch failed attempts. The attack shows up only in the wider picture — login attempts with the same password across many accounts within a fairly short window. One hit is enough for the attacker to be inside the network.

Examples

• The attacker tries "Password123" on every account in the company; on most it fails, but if one employee uses exactly that password, the attack has worked.
• The more employees a company has, the better the odds that somebody this year picked "Company2026!" as their password — "CrvenaPilula2026!", for instance.
• The seasonal password "Winter2025!" can be tried against hundreds of accounts before anyone notices anything.

Notes

• The difference from brute force is direction — not many passwords against one account, but one password against many accounts, so the lockout mechanisms never fire.
• This attack cannot be seen on a single account, only in the pattern. Anyone watching individual misses will not find it. But misses across most accounts within a short interval put you on the trail of something.