Password spraying and credential stuffing

Classic brute-force on one account triggers lockout. Two variants sidestep it by working horizontally.

The two techniques

Password spraying: try one common password (Summer2026!) across many accounts, staying under each account's lockout threshold. In large organizations someone always has it.

Credential stuffing: reuse email/password pairs leaked from other breaches, betting on password reuse across sites. Automated at scale.

# spraying: 1 password x N users, with pauses between rounds
# stuffing: millions of pairs from a combolist against the login

Defence

MFA (kills both nearly entirely). Rate- and pattern-based detection (many accounts, one IP; many failed logins from a botnet). A password policy banning common ones and checking against breached-password lists (HIBP). Smart lockout and CAPTCHA/rate limiting. Alert users to logins from new locations.