Instead of guessing many passwords for one account, which triggers a lockout, the attacker tries one or two likely passwords across every account in a company. Shared and seasonal passwords make it work.
Spraying often shows up as failed sign-ins from many places at once. Accounts without MFA, such as shared mailboxes, are the usual way in.
How Centeye handles it
Centeye Gatewatch spots password sprays across Microsoft 365 and Google Workspace and points to the account that needs MFA.
Gatewatch: identity protection (ITDR) →