Password Spraying Attacks Surge 155x as Hackers Exploit MFA Gaps

Attack Volume Hits Unprecedented Scale

Security firm Huntress has published findings revealing a 155-fold increase in password spraying attacks during the first half of 2026. In one documented campaign alone, threat actors generated more than 81 million login attempts over a two-week window — a volume that overwhelmed traditional rate-limiting defenses at many organizations.

Password spraying differs from traditional brute-force attacks: rather than hammering a single account with many passwords, attackers try a small number of common passwords across a massive list of accounts. This avoids triggering per-account lockout policies while still achieving high success rates at scale.

How Attackers Are Bypassing MFA

The Huntress report highlights two primary exploitation vectors enabling this surge:

1. Legacy Authentication Protocols

Many organizations still expose legacy authentication endpoints — IMAP, POP3, SMTP AUTH, and Basic Authentication for Exchange/ActiveSync — that were designed before MFA existed. These protocols pass credentials in cleartext or simple base64 encoding and cannot enforce MFA. Even organizations with conditional access policies often leave these protocols unblocked, creating a parallel login path that bypasses modern controls entirely.

2. MFA Policy Gaps

Even in environments with MFA deployed, incomplete policy coverage leaves critical gaps:

Campaign Mechanics

Huntress observed campaigns operating with significant infrastructure investment:

• Distributed attack infrastructure: Requests originating from thousands of IP addresses across residential proxies and cloud providers to evade IP-based blocking
• Slow-and-low timing: Some campaigns intentionally paced attempts below per-IP thresholds — as few as 1-2 attempts per IP per day — to avoid detection
• Targeted credential lists: Leaked credential databases from prior breaches used to prioritize known-valid usernames, reducing wasted attempts
• Platform targeting: Microsoft 365, Azure AD, Google Workspace, and Okta were the most commonly targeted identity platforms

Who Is at Risk

Small and mid-sized organizations are disproportionately affected — they are more likely to have legacy protocols enabled and less likely to have invested in identity threat detection tooling.

Recommended Defenses

Immediate Actions

# Azure AD / Entra ID — block legacy authentication via Conditional Access
# Policy: Block Legacy Authentication
# Conditions: Client apps = Exchange ActiveSync clients + Other clients
# Grant: Block access

1. Disable all legacy authentication protocols at the identity provider, email server, and network perimeter
2. Audit MFA coverage — ensure every user, every app, and every authentication path requires MFA
3. Enable Microsoft Entra ID Protection (or equivalent) to detect and auto-remediate risky sign-ins
4. Implement phishing-resistant MFA (FIDO2/passkeys) for privileged accounts

Detection

-- Microsoft Sentinel KQL — detect password spray patterns
SigninLogs
| where TimeGenerated > ago(1h)
| where ResultType != 0  // failed sign-ins
| summarize FailedAttempts = count(), UniqueUsers = dcount(UserPrincipalName)
    by IPAddress, bin(TimeGenerated, 10m)
| where UniqueUsers > 10 and FailedAttempts > 20
| project TimeGenerated, IPAddress, UniqueUsers, FailedAttempts
| order by FailedAttempts desc

Longer-Term Hardening

• Move to phishing-resistant MFA (passkeys, FIDO2 hardware keys) for all users — SMS and TOTP remain vulnerable to real-time phishing
• Deploy a Privileged Access Workstation (PAW) program for admin accounts
• Implement Continuous Access Evaluation (CAE) to revoke sessions in real-time on policy change
• Adopt a Zero Trust network model — validate every access request regardless of network location

Industry Context

The 155x increase aligns with broader trends observed by Microsoft, CrowdStrike, and Mandiant in their respective 2026 threat reports. Credential-based attacks now account for the initial access vector in over 60% of cloud breaches, according to Huntress data. The dramatic scale increase in H1 2026 correlates with:

• Widespread availability of large credential dumps from 2024-2025 breach incidents
• Commoditization of password-spray-as-a-service tooling in cybercriminal forums
• Increased cloud adoption expanding the attack surface of externally-facing identity services

Key Takeaways

• Password spraying has become a volume play at industrial scale — 81 million attempts in two weeks is not an outlier but a trend
• Legacy authentication is the #1 enabler — organizations that block it eliminate a major attack surface overnight
• MFA gaps, not MFA failures, are the root cause in most successful intrusions
• Detection must account for distributed, slow-velocity attacks that stay under per-IP thresholds

References

• BleepingComputer — Password Spraying Attacks Surge 155x
• Huntress H1 2026 Threat Report

Related Reading

• NIST SP 800-63B — Digital Identity Guidelines
• CVE-2026-32470: Critical PHP Object Injection in FundEngine Plugin