Password Spraying Attacks Surged 155x in 2026: What You Need to Know

Also on CyberFence: CyberFence Breach Monitor for continuous breach alerts · run a free breach check on your email .

In the first six months of 2026, password spraying attacks increased by 155 times compared to the same period a year earlier. That number comes from Huntress's threat research team, which documented a single campaign between June 12 and June 26 that generated more than 81 million login attempts against their customers' Microsoft accounts — and successfully compromised 78 accounts across 64 organizations in just two weeks.

Password spraying is not new. But the scale, automation, and sophistication of these attacks in 2026 represent a meaningful escalation. Understanding how it works — and why defenses that work against one type of credential attack don't always work against another — is increasingly relevant for anyone who uses work accounts, cloud services, or email.

What Password Spraying Actually Is

Password spraying is the opposite of what most people picture when they think about account hacking. Instead of trying many passwords against one account (a brute force attack that locks the account after a few failed attempts), password spraying tries one or two common passwords against thousands of accounts simultaneously.

The logic is simple: if you try "Password1!" against 50,000 accounts, even a 0.1% success rate yields 50 compromised accounts — and you've never triggered a lockout on any of them, because each individual account only saw a single failed login.

Common passwords used in spray attacks include variations of the current year ("Summer2026!", "September2026"), corporate name patterns ("[Company]2026"), keyboard walks ("Qwerty12!"), and seasonal patterns that IT teams sometimes set as temporary passwords. Attackers maintain lists of these patterns and update them as the year and common practices change.

This is distinct from credential stuffing — another common attack that uses username/password pairs already stolen from previous breaches and tests them against new targets. Password spraying does not require stolen credentials; it succeeds through predictability.

The 2026 Surge: What the Data Shows

The 155x increase documented by Huntress is not an isolated outlier. Multiple data sources point to the same trend:

• Huntress (H1 2026): 155x increase in credential spray attacks across their customer base. Current mean of approximately 1,964 failed spray attempts per protected tenant per month, with a median of 804. (Source: Huntress)
• Microsoft Digital Defense Reports (2024/2025): Microsoft blocks more than 7,000 password attacks per second — up from 579 per second in 2021, a twelvefold increase in four years. 97% of identity attacks involve password spray or brute force techniques.
• Guardz (2026): Over 14,000 unique password-spray source IPs per month, each targeting 10 or more accounts, with spray infrastructure growing approximately 13% month over month.
• MojoAuth (2025 data): 37 million password spray attempts recorded, with a median success rate of 1.8% — meaning nearly 1 in 50 spray attempts successfully compromises an account when they reach a valid target.

The June 2026 Huntress campaign is particularly instructive. Attackers used an IPv6 address range controlled by infrastructure provider LSHIY LLC to send over 81 million authentication attempts against Microsoft's Azure CLI — the command-line tool that administrative users use to manage cloud resources. The attack exploited legacy OAuth Resource Owner Password Credential (ROPC) flows, which bypass the standard interactive login page where MFA is typically enforced.

Why Password Spraying Is Surging in 2026

Several converging factors explain why these attacks have become so prevalent:

Legacy Authentication Protocols That Bypass MFA

The LSHIY campaign specifically exploited OAuth ROPC flows — an older authentication method that Microsoft supports for backward compatibility but that does not prompt for multi-factor authentication. Attackers have become skilled at identifying which authentication pathways in cloud environments bypass MFA enforcement, then directing spray campaigns specifically at those pathways.

This is why the 155x increase happened despite widespread MFA adoption. Organizations added MFA to their standard login flows but left legacy authentication endpoints open, and attackers shifted to those endpoints. Microsoft has been progressively disabling legacy authentication protocols, but migration has been gradual and uneven across organizations.

Automation at Scale

What required significant technical skill five years ago is now commoditized. Password spray toolkits are freely available, infrastructure costs have dropped dramatically (IPv6 ranges are abundant and cheap), and cloud APIs have standardized authentication interfaces that make targeting easier. A single attacker with modest technical skills can sustain campaigns generating millions of daily login attempts.

The Password Reuse and Predictability Problem

Spray attacks succeed because a meaningful percentage of accounts use predictable passwords. Verizon's 2025 DBIR found that 2.8 billion passwords were posted on criminal forums in 2024 alone, and only 3% of those met basic complexity requirements. When attackers know what patterns IT teams commonly use for temporary passwords, reset passwords, and seasonal updates, their spray lists become increasingly effective.

Cloud Service Consolidation

The consolidation of enterprise authentication through Microsoft 365, Google Workspace, and similar platforms creates highly attractive targets. A single successful spray against one of these platforms doesn't yield access to one application — it can yield access to email, documents, collaboration tools, and sometimes cloud infrastructure management. The return on investment for attackers is high.

How Password Spraying Differs From Credential Stuffing

These two attack types are often confused because both target account credentials at scale. The key differences:

• Credential stuffing uses stolen username/password pairs from previous breaches and tests them against other services, betting on password reuse. It requires access to breach data and is most effective against users who reuse passwords across services.
• Password spraying does not require stolen data. It uses predicted common passwords and tests them against many accounts, designed to stay under account lockout thresholds. It is most effective against accounts with weak or predictable passwords and against authentication endpoints that lack MFA.

The same account can be targeted by both types simultaneously. An account with a predictable password that the user also used on a breached site is doubly vulnerable. The defenses overlap — strong unique passwords and properly enforced MFA address both — but spray attacks require specific attention to legacy authentication protocols that stuffing attacks may not exploit.

What Organizations and Individuals Can Do

The security community's response to the spray surge involves several layers:

Eliminate Legacy Authentication

For organizations using Microsoft 365 or Azure: disable ROPC flows, basic authentication, and other legacy protocols that bypass conditional access policies. Microsoft's documentation on legacy authentication provides migration guidance. This removes the primary vector exploited in the LSHIY campaign.

Apply MFA to Every Login Flow

The June 2026 attack succeeded precisely because legacy authentication endpoints were excluded from MFA enforcement. MFA must apply to every authentication pathway, not just the interactive login page most users see. Phishing-resistant MFA methods (hardware keys, passkeys, number-matching prompts) are more resistant to some bypass techniques than SMS-based methods.

Use Unique, Complex Passwords

Password spraying depends on predictability. If every account has a genuinely random, unique password, spray attacks fail regardless of how many attempts are made. A password manager makes this practical — users don't need to memorize complex unique passwords for every service.

Monitor Authentication Anomalies

Spray campaigns are visible in authentication logs as unusual spikes in failed login attempts, often during off-hours, from unusual IP ranges, or against specific authentication endpoints. Organizations with centralized identity logging (Azure AD Sign-in Logs, Okta system logs) can detect spray campaigns early.

Protect Credentials in Transit

When employees authenticate to cloud services from untrusted networks — hotel Wi-Fi, airport lounges, client site networks — credentials transmitted over unencrypted connections can be intercepted before they ever reach the authentication server. A VPN with AES-256-GCM encryption ensures that authentication traffic from work devices is encrypted end-to-end regardless of the network, and Web Shield DNS blocking prevents redirection to credential-harvesting lookalike login pages.

The Bigger Picture: Identity Is Now the Primary Battleground

The password spraying surge is part of a broader shift in how attacks are conducted. According to Microsoft's analysis, more than 97% of identity attacks are password-based — spray, stuffing, or brute force. Attackers have learned that compromising an identity is often easier and more valuable than exploiting a technical vulnerability.

A compromised Microsoft 365 account grants access to email (for business email compromise fraud), files (for data theft or ransomware staging), and often becomes a launchpad for attacks on the rest of the organization. The 78 accounts compromised in the June LSHIY campaign represent 78 potential entry points into 64 organizations — each one a potential ransomware deployment or business email compromise incident.

This is why the authentication layer increasingly needs defense in depth: unique passwords that resist spray, properly enforced MFA that covers every login flow, encrypted connections that protect credentials in transit, and DNS-level blocking that stops credential-harvesting pages from loading in the first place.

Want to go deeper? Read how CyberFence Breach Monitor works , the free CyberFence breach check tool , or the CyberFence password strength tool .