Protect Yourself from Password Spraying Attacks

This advisory explains password spraying (a "low-and-slow" or reverse brute-force technique) where attackers try common passwords across many usernames to avoid account lockouts. It cites research showing a large portion of observed unauthorized login attempts targeted Microsoft 365 and G Suite—with roughly 25% of those attempts able to breach accounts—and notes common originating countries. The report concludes with mitigation guidance: use complex unique passwords, enable multi-factor authentication, enforce password rotation policies, and ensure users sign out after sessions.