Password Spraying Attacks on the Rise
Password spraying attacks have surged 155x in the first half of 2026, according to Huntress Labs. These attacks involve hackers attempting to gain access to accounts by trying a small number of commonly used passwords against a large number of usernames.
How Password Spraying Attacks Work
A typical password spraying attack follows a familiar pattern: reconnaissance, building a password list, spraying passwords across accounts, and gaining a foothold. The attacker collects valid usernames via LinkedIn, company websites, data breach dumps, and phishing to create a target list.
- Reconnaissance: The attacker collects valid usernames via LinkedIn, company websites, data breach dumps, and phishing to create a target list.
- Build password list: The attacker assembles a short list of breached passwords, common passwords, company name variants, or seasonal terms.
- Spray across accounts: The attacker tries one password against every account on the target list, heeding lockout thresholds, and waits before moving to the next password in a low and slow approach.
- Gain a foothold: If granted access, the attacker pivots to lateral movement, business email compromise (BEC), data exfiltration, or further credential theft.
The LSHIY Campaign
The LSHIY campaign combined password-spraying scale with the reuse of valid username-and-password pairs from previous breaches that were never rotated. This made each successful attempt more valuable than a typical guess. The attacker also abused Resource Owner Password Credentials (ROPC), a legacy OAuth grant deprecated in OAuth 2.1.
ROPC doesn’t support modern authentication flows like MFA or SSO. Instead, it sends the username and password straight to the /token endpoint, with no interactive MFA prompt. For an attacker, a reused password that still works can become an active session.
Even though we call it an authorization method, it’s technically an impersonation method. - Andrew “Spike” Brandt, Principal Threat Intelligence Incident Commander at Huntress
Mitigation Strategies
To close the gaps these attacks rely on, organizations should enforce password hygiene, consider passwordless options, disable ROPC, restrict the Azure CLI application for non-admin users, and prioritize response by credential validity instead of spray volume.
- Enforce password hygiene, consider passwordless options
- Disable ROPC (or apps that rely on it) from your system
- Restrict the Azure CLI application for non-admin users
- Don't prioritize response by spray volume, since the most heavily sprayed tenants are often the least compromised.
- Prioritize by credential validity instead.
- Require MFA for all users, all cloud apps, and all client app types, with no exclusions.
- Block authentication methods that can’t satisfy an MFA requirement, including the legacy ROPC grant.
- Use a strong Conditional Access setting like userStrongAuthClientAuthNRequired to enforce strong authentication at the client level and block ROPC.
Appropriately configured and managed conditional access is a superpower. - Rich Mozeleski, Staff Product Manager at Huntress
Conclusion
Password spraying attacks are a significant threat to organizations, and it’s essential to take steps to prevent them. By enforcing password hygiene, disabling ROPC, and requiring MFA for all users, organizations can shut down these attacks and protect their environments.
Tradecraft Tuesday provides cybersecurity professionals with an in-depth analysis of the latest threat actors, attack vectors, and mitigation strategies. Each weekly session features technical walkthroughs of recent incidents, comprehensive breakdowns of malware trends, and up-to-date indicators of compromise (IOCs).
Source: BleepingComputer