Brute-force attacks lock accounts after too many failed attempts. Password spraying avoids this by trying one common password against thousands of accounts. It's the most common automated attack against Microsoft 365 in New Zealand — and it succeeds when MFA isn't enforced.
Most Microsoft 365 tenants configure account lockout after a set number of failed login attempts — typically five to ten. A brute-force attack that tries thousands of passwords against a single account triggers lockout quickly and is easily detected. Password spraying inverts this: rather than trying many passwords against one account, it tries one (or a very small number of) passwords against thousands of accounts.
Try "Winter2024!" against the first 10,000 accounts you can enumerate from LinkedIn for a target company. If even 1% of those accounts use that password — 100 accounts — the attack is highly successful, and no account ever received enough failed attempts to trigger lockout. This is password spraying, and it's currently the dominant credential attack technique against Microsoft 365.
How Attackers Identify Target Accounts
Microsoft 365 email addresses are typically the same as Microsoft 365 login names — and email addresses are publicly available. Staff LinkedIn profiles, company websites, email signatures, and domain enumeration tools all provide target email addresses. A spray attack against a 100-person NZ business can enumerate all staff email addresses in minutes from public sources before the first password attempt is made.
The Passwords Attackers Try
Password spray attacks use predictable password lists: seasonal passwords (Summer2024!, Winter2023!), company-name-based passwords (Companyname1!, Companyname123), common corporate patterns (Password1!, Welcome1!), and newly common variations that are statistically overrepresented in credential breach databases. Attackers update their spray lists to reflect current seasons and current year — "Summer2024!" was heavily sprayed throughout NZ's summer of 2023–2024.
Detection and Prevention
Without MFA: a successful spray attack grants immediate full account access. The attacker logs in normally — no alerts, no suspicious activity (from an authentication perspective, a correct password from anywhere grants access). With MFA: a correct password doesn't grant access — the attacker still needs the second factor. The spray attack that succeeded in capturing a credential has produced nothing usable.
Microsoft Entra ID tracks sign-in risk and can flag spray attack patterns based on distributed failed authentication attempts. Smart Lockout (enabled by default in Entra ID) blocks repeated failed authentication from external IPs while still allowing legitimate users to authenticate. But the primary defence remains MFA — making the captured credential worthless.
Password spraying is quiet, patient, and effective against accounts without MFA. It's among the most common causes of Microsoft 365 account compromises in NZ. The one control that stops it completely, every time, is MFA on every account.
