Password Spraying Attacks Surge 155x Exploiting MFA Gaps

Huntress observed a 155x surge in password spraying attacks during the first half of 2026, indicating a significant escalation in this type of cyber threat. One notable campaign identified by Huntress generated over 81 million login attempts within a two-week period, highlighting the scale and intensity of these operations. These attacks predominantly exploited vulnerabilities in legacy authentication systems and identified gaps within multi-factor authentication (MFA) policies. The attackers specifically targeted login flows that were not adequately protected by MFA, allowing them to bypass security measures that would typically prevent unauthorized access. This trend suggests that while MFA is widely adopted, its implementation is not always comprehensive, leaving certain pathways open for exploitation.

Password spraying is a brute-force attack method where an attacker uses a small list of common passwords against a large number of user accounts. Unlike traditional brute-force attacks that focus on a single account with many password attempts, password spraying aims to compromise multiple accounts with a single, commonly used password. This technique is effective because many users opt for weak or easily guessable passwords, and organizations may not have robust lockout policies in place to detect such widespread, low-and-slow attempts. The increase observed by Huntress points to attackers refining their tactics to circumvent existing security controls, particularly those related to authentication.

The exploitation of legacy authentication methods is a critical concern, as these older systems often lack modern security features and may not support advanced authentication protocols. Organizations that continue to rely on these systems are inherently more vulnerable. Furthermore, the identified gaps in MFA policies suggest that many organizations have not fully secured all access points. This could include specific applications, services, or user roles that have been inadvertently excluded from MFA enforcement, creating blind spots for attackers to exploit. The sheer volume of login attempts in the identified campaign underscores the potential for widespread account compromise if these vulnerabilities are not addressed promptly.

Huntress's findings serve as a critical alert for cybersecurity professionals and organizations worldwide. The data indicates a clear shift in attacker strategies, moving towards exploiting the nuances of authentication implementations rather than solely focusing on breaking strong passwords. This necessitates a review and hardening of all authentication mechanisms, including a thorough audit of MFA coverage across all systems and applications. Organizations must ensure that their MFA policies are uniformly applied and that legacy systems are either upgraded or decommissioned to eliminate these exploitable weaknesses. The continued reliance on incomplete security measures leaves businesses susceptible to significant data breaches and operational disruptions.