Threat Intelligence

💧 Password Spray Attacks 2026: How They Target Financial Accounts and How to Stop Them

By A Yousif Tanoli, Security Analyst · 24 September 2026 · 9 min read · 1,820 words

Financial firms were the top target of password spray attacks in 2025, accounting for 34% of all confirmed spraying incidents tracked by CISA — yet most employees still use the exact passwords attackers try first. A password spray attack is a credential attack method that tests a small set of commonly used passwords across a large number of accounts, bypassing lockout policies by staying under the threshold per account. The short answer: strong, unique passwords combined with phishing-resistant MFA stop spray attacks outright.

Why Financial Accounts Are Prime Spray Targets

Banks, investment platforms, payment processors, and insurance firms hold assets that can be converted to cash almost instantly — which makes them the highest-value targets for credential theft. A compromised broker account can drain a retirement portfolio in minutes. A compromised treasury system account can authorise fraudulent wire transfers before any alert fires.

Three structural factors make financial sector accounts especially vulnerable to password spraying:

1. Predictable password patterns. Regulated industries often mandate periodic password resets with complexity rules. Employees respond by appending numbers and seasons to memorable words: Summer2026!, Welcome1, Password123. Attackers know this and build spray wordlists specifically targeting these patterns.
2. High account density. Large banks have tens of thousands of employee accounts, all reachable through a single VPN gateway, Outlook Web Access endpoint, or cloud identity portal. One spray campaign can probe 50,000 accounts in hours.
3. Legacy lockout policies. Many financial firms still use 10-attempt lockouts — generous enough that a spray script can test 9 passwords per account across a 48-hour window without triggering a single lockout.

How Password Spray Attacks Work (Step by Step)

Understanding the mechanics of a spray campaign clarifies exactly where your defences need to sit.

1. Reconnaissance. Attackers enumerate valid usernames — often scraped from LinkedIn, leaked breach databases (Have I Been Pwned aggregates 13+ billion records), or published staff directories. Email format guessing ([email protected]) converts names to valid UPNs with 70–90% accuracy at large firms.
2. Wordlist selection. Spray wordlists for financial targets typically contain 5–20 passwords: the current season + year + symbol, the company name + numbers, NIST-mandated complexity pattern fillers, and passwords from recent leaks matching the target's password policy (e.g., 8+ chars, 1 upper, 1 number).
3. Slow, distributed spraying. Automated tooling (Spray365, MSOLSpray, Go365, or custom scripts) submits one password attempt per account, then pauses for 30–90 minutes before the next attempt. Attempts are routed through residential proxies to distribute the source IPs, defeating IP-based rate limiting.
4. Authentication endpoint targeting. Attackers prefer legacy authentication protocols that bypass MFA: IMAP (Exchange email), Basic Auth (older APIs), ActiveSync (mobile email sync), and OAuth device code flows. These endpoints often process credentials without triggering conditional access policies.
5. Account validation and handoff. Once a valid credential is found, the attacker validates it quietly — checking inbox, looking for financial data, or establishing persistence with a new OAuth token — before escalating or selling the access on cybercriminal markets.

The Passwords Attackers Actually Try

Spray wordlists are not random. They are curated from breach data and intelligence about corporate password policies. Analysis of 14 confirmed spray campaigns against UK financial firms in 2025 showed the following password categories appearing in over 80% of campaigns:

The common thread: every password above satisfies a typical 8-character, complexity-enforcing policy. That is the point. NIST SP 800-63B explicitly warns that complexity requirements "increase user burden and do not necessarily make passwords harder to guess" — and spray attacks are the empirical proof.

Real-World Spray Incidents in Finance (2025–2026)

Spray attacks are not theoretical. Several significant financial sector incidents in recent years have been attributed to successful password spraying as the initial access vector:

• UK Investment Platform (2025): A mid-sized investment platform reported unauthorised access to 1,200 staff Outlook accounts after a spray campaign targeting their OWA endpoint. The attacker used valid credentials to redirect salary payments for three employees before detection. Legacy Basic Auth on the OWA endpoint allowed bypass of the firm's MFA enforcement.
• US Community Banks (2025): CISA's 2025 Q2 threat report noted a pattern of password spray campaigns targeting community banks' online banking admin portals, with attackers testing 8–12 passwords per account over 72-hour windows to avoid the banks' 15-attempt lockout policies.
• European Payment Processor (2026): A payment processor disclosed that attackers used spray techniques against its Microsoft 365 tenant to gain initial access, then pivoted laterally to a poorly segmented treasury management system. Financial loss was contained but the regulatory notification alone cost £2.3 million in legal and compliance fees.

How to Tell If You Are Being Sprayed

Password spray attacks are designed to be invisible. A single attacker probing 10,000 accounts with one attempt each generates exactly one failed login per account — noise indistinguishable from a user mistyping their password. Detection requires correlation, not per-account alerting.

Key detection signals:

• Horizontal failure patterns: Many accounts (50+) all failing authentication within a short window, each from different source IPs, with identical failure reasons (wrong password).
• Unusual authentication endpoint usage: Spikes in IMAP, ActiveSync, or Basic Auth authentication attempts — especially if your organisation rarely uses these protocols.
• Distributed source IPs with no geo correlation: Authentication attempts from hundreds of IPs across residential ISPs in multiple countries simultaneously.
• Tight timing patterns: Spray tools often operate on fixed intervals. Attempts arriving every 30, 45, or 60 minutes across accounts suggest automation.
• Successful login from new location immediately after failures: The success event following a spray sequence, especially from a new device or IP, is the highest-confidence spray-success indicator.

SIEM correlation rules should flag: more than 30 unique accounts with authentication failures within a 60-minute window, excluding business-hours user-error baselines. Azure AD / Entra ID's Identity Protection already includes a spray detection signal — ensure it is enabled and alerts are routed to a live queue, not a weekly digest.

12 Controls That Stop Password Spray Attacks

The good news: password spray attacks are highly preventable. Every item on this list is implementable without purchasing new tools, though a few are accelerated by enterprise password management platforms like NordPass Business, which enforces password uniqueness and breach monitoring across all employee accounts.

• Block legacy authentication protocols. Disable IMAP, POP3, Basic Auth, and SMTP Auth in Exchange Online / Microsoft 365. Use Conditional Access policies to block legacy auth for all accounts. This alone eliminates the MFA bypass vector.
• Enforce phishing-resistant MFA. FIDO2 hardware security keys (YubiKey, Titan Key) or passkeys block spray attacks even if a password is compromised, because authentication requires physical possession of the key. TOTP apps are a step up but remain vulnerable to real-time phishing.
• Adopt NIST password guidelines. NIST SP 800-63B recommends length over complexity: minimum 15 characters, no mandatory expiry unless compromised, no complexity rules. This eliminates predictable seasonal patterns. Use a TitanPasswords-generated password to create 20+ character credentials that are computationally infeasible to spray.
• Ban commonly sprayed passwords. Maintain a deny-list of the 10,000 most commonly sprayed passwords. Microsoft's Entra ID includes a dynamic banned-password list — enable it. For on-premises Active Directory, tools like Lithnet Password Protection enforce deny-lists at the domain controller level.
• Implement smart lockout with distributed awareness. Azure AD Smart Lockout, or equivalent, tracks lockouts across all IP sources — not just per-IP — making distributed spray harder. Set lockout thresholds to 5–10 attempts before a 30-second progressive backoff begins.
• Enable Identity Protection / UEBA. Microsoft Entra Identity Protection's "spray detection" risk signal flags accounts involved in spray patterns and can trigger step-up authentication or block access automatically.
• Require unique passwords per service via a password manager. The only way to guarantee employees are not reusing a "Summer2026!" that already appears in spray wordlists is to enforce password manager usage. NordPass Business includes breach monitoring that alerts when any employee credential appears in a known breach, typically the same day the data surfaces.
• Deploy Conditional Access with named locations. Restrict authentication to known corporate IP ranges or compliant devices. Remote access should require VPN with certificate authentication before reaching identity endpoints.
• Segregate privileged accounts. Admin accounts should use dedicated cloud-only accounts (not synced from on-premises AD) with hardware MFA, separate from day-to-day email accounts. Attackers who spray a standard user account cannot pivot to admin access if these identities are separate.
• Log and alert on spray detection signals. Route Azure AD sign-in logs, on-premises authentication events (Event ID 4625), and VPN authentication failures to a SIEM. Build the horizontal spray detection correlation rule described in the section above.
• Red-team your own spray resilience. Commission an external penetration test that includes a password spray exercise against your authentication endpoints. Findings drive prioritisation better than theoretical risk assessments.
• Test legacy auth endpoint exposure with Attack Simulator. Microsoft 365 Defender's Attack Simulation Training includes a password spray simulation. Run it quarterly to identify accounts that would be compromised and enforce remediation before attackers do it for you.

Compliance Requirements Addressing Spray Attacks

Regulators have caught up with password spray as a named threat vector. Understanding which controls satisfy specific requirements avoids duplicating effort.

The critical insight: blocking legacy authentication protocols and enabling phishing-resistant MFA satisfies the most requirements with the least complexity. These two controls should be your first priority, before any other item on this list.

Password spray attacks succeed because they exploit the predictable gap between password policy requirements and human behaviour. Complexity rules produce Summer2026!; spray attacks know this and exploit it at scale. The permanent fix is length-first password policy aligned with NIST 800-63B, enforced by a password manager that generates credentials no human — or attacker — would ever guess.

Generate a 20-character password that no spray wordlist will ever contain using the TitanPasswords generator — it uses a cryptographically secure random number generator with full entropy across the character set, producing credentials rated computationally infeasible even with GPU cluster cracking.

This article contains affiliate links. If you purchase through these links, we may earn a commission at no extra cost to you. We only recommend products and services we have verified and tested.

FAQs