Why Hackers Love Password Spraying (and Your MFA Won't Save You)

Robert Moore · 2026-08-19

You'd think that after years of warnings, we'd all be tired of hearing about password attacks. But here's the thing: the bad guys aren't tired. They're actually getting smarter, and they've found a loophole that's making traditional security measures look almost useless. A recent report from security firm Huntress shows just how bad things have gotten. In the first half of 2026, they watched password spraying attacks skyrocket by 155 times compared to previous levels. That's not a typo. One single campaign generated over 81 million login attempts in just two weeks. Let that sink in for a moment. ### What Exactly Is Password Spraying? Unlike a brute-force attack where hackers try thousands of passwords on a single account, password spraying takes the opposite approach. Attackers pick a handful of commonly used passwords—like "Winter2026!" or "CompanyName123"—and try them against thousands or millions of different accounts. Think of it like a burglar trying one key on every door in a neighborhood instead of picking one lock with a thousand keys. It's slower per account, but it's much harder to detect because you're not triggering lockout policies. ### The MFA Illusion Here's where it gets uncomfortable: most people believe multi-factor authentication (MFA) makes them untouchable. And honestly, it does help. But the Huntress data reveals a critical blind spot. Many organizations only enforce MFA on certain login flows—like web portals—while leaving others wide open. Legacy authentication methods, like POP3, IMAP, or older Active Directory sync protocols, often bypass MFA entirely. Hackers know this. They're not breaking into your modern, protected systems. They're targeting the back door you forgot to lock. - Legacy protocols often lack MFA enforcement - Service accounts and API connections frequently bypass conditional access policies - Third-party apps may not support modern authentication standards ### The Real-World Impact The 81 million login attempts campaign wasn't just a numbers game. The attackers were methodical. They targeted specific industries—healthcare, finance, and education—where the payoff for a successful login is high and the security budget is often stretched thin. When they do get in, they don't just steal data. They plant ransomware, establish persistence, and quietly exfiltrate sensitive information over weeks or months. The average cost of a data breach in the United States now exceeds $4.5 million, according to IBM's latest research. That's not just a tech problem; that's a business survival problem. ### Why Traditional Defenses Fail Your standard security stack—firewall, antivirus, SIEM—isn't designed to catch this. Password spraying looks like normal login traffic. It's spread out over time and across many accounts, so it doesn't trigger the usual alarms. Rate limiting helps, but attackers have learned to slow down and mimic human behavior. They'll use residential proxy networks to rotate IP addresses, making it nearly impossible to block by reputation. ### What Actually Works If you're responsible for securing your organization, here's what the experts recommend: - **Enforce MFA everywhere**, including legacy protocols. If a system doesn't support MFA, get rid of it. - **Use conditional access policies** to block sign-ins from untrusted locations or devices. - **Monitor for impossible travel**—a user logging in from New York and Tokyo within 10 minutes is a red flag. - **Implement passwordless authentication** where possible, like FIDO2 security keys. - **Audit your service accounts** and remove any that aren't absolutely necessary. ### The Bottom Line Password spraying isn't a new attack, but it's becoming the weapon of choice because it works. The MFA gaps are real, and attackers are actively exploiting them while most security teams are focused on the wrong threats. Don't wait for a breach to find out where your blind spots are. Take a hard look at your authentication flows today. The 81 million login attempts are just the beginning—the next wave is already coming. If you're in the security trenches, you know how exhausting this is. But staying one step ahead means questioning every assumption you have about what's protected and what isn't. Because the hackers certainly are.