Password attacks explained: credential stuffing, spraying and brute force

Password attacks are attempts to get into an account by obtaining or guessing its password, rather than by breaking the service’s own security. They are a common way for email, social media, shopping and work accounts to be taken over. This guide explains the main types in plain terms (credential stuffing, password spraying, brute force and phishing for passwords) so the defences make sense, then covers why reusing passwords matters and what ASD’s ACSC says about multi-factor authentication (MFA), passkeys and password managers.

Why password attacks work

A password is a shared secret. Anyone who knows it can usually sign in as the owner. Attackers don’t need to guess every password in the world; they rely on a few predictable habits:

• people reusing the same password on many sites
• short or common passwords that are easy to guess
• passwords typed into fake sign-in pages
• passwords saved on a device that later gets malware.

Each attack type below exploits one of these habits, and each has a matching defence.

Types of password attack

Credential stuffing

When a website suffers a data breach, lists of email addresses and passwords can end up in criminal hands. In credential stuffing, attackers take those username-and-password pairs and automatically try them on other websites, betting that some people used the same combination elsewhere. ASD’s ACSC multi-factor authentication guide gives credential stuffing as an example of the password-related attacks MFA helps defend against. ASD’s ACSC also makes the underlying point in its data breach guidance: “If you have reused this password across other online accounts, they also may be at risk.” It also warns that a data breach “may lead to the compromise of your online accounts, including banking”.

The point is that the account being attacked was never breached itself. If the password is unique, the stolen pair simply doesn’t work anywhere else. See what happens after a data breach.

Password spraying

Password spraying flips the usual approach. Instead of trying many passwords on one account (which tends to trigger a lockout), the attacker tries a small number of common passwords across many accounts. ASD’s 2019 advisory on password spray attacks (still published on cyber.gov.au) says “Malicious cyber actors may attempt a set number of logins based on the default, or expected lockout threshold”, staying just under it. It describes these attacks targeting services such as webmail, remote desktop access and cloud-based services.

Microsoft’s incident response guidance for organisations describes “low and slow” attack indicators as “when thresholds for account lockout or bad passwords aren’t being hit”, which is what makes spraying hard to spot.

Brute force

Brute force means trying a very large number of possible passwords against an account or a stolen password file until one works. It is slow against long, random passwords and fast against short or predictable ones. ASD’s passphrase guidance says: “The longer the passphrase, the harder it is for adversaries to crack.”

Phishing for passwords

Rather than guessing, many attackers simply ask. A fake email or text leads to a sign-in page that looks like the real one, and the password typed in goes straight to the attacker. ASD’s guidance on socially engineered messages says: “Never enter credentials into websites if directed there by a link in a message.” See how phishing, smishing and vishing work and social engineering tactics explained.

Stolen from the device

Information stealer malware copies passwords saved in browsers, along with session cookies. ASD’s infostealer advisory notes that “Some web browser authentication cookies keep a user logged into an account or service for multiple days at a time”, and that stolen cookies “could effectively bypass MFA requirements”. See malware and spyware explained.

A fictional example

Jordan used the same password for an old gaming forum and his email. Years later the forum, games.example, is breached. Attackers feed the leaked email-and-password pairs into an automated tool that tries them against popular email services. Jordan’s works. The attacker resets the passwords on his shopping and social media accounts through his inbox. If Jordan’s email password had been unique, or his email had MFA turned on, the stolen pair alone wouldn’t have opened it.

Why password reuse matters

Reuse turns one breach into many. ASD’s ACSC password manager page says: “It may be tempting to reuse a password, but if compromised it can put all your devices and accounts at risk.” Its data breach guidance says other accounts that reused the password “also may be at risk” and recommends a unique password for each account, and its recovery guide says to “reset all accounts that use that same password as soon as possible”.

How to defend against password attacks: what ASD describes

Multi-factor authentication

MFA asks for something extra, such as a code, an app approval or a security key, as well as the password. ASD’s passphrase page calls MFA “one of the most effective ways to protect your accounts from cybercriminals”, and ASD’s password spray advisory says “MFA is highly effective at mitigating brute force and password spray attacks”. ASD’s infostealer advisory says: “Best practice is to implement phishing-resistant MFA on all accounts.” See MFA methods compared.

Passphrases

ASD describes a passphrase as “four or more random words” used as a password, and says “the longer your passphrase, the better.”

Password managers

ASD says “Password managers can help you create, manage and store passwords for each of your accounts”, so only one master login has to be remembered. ASD’s page notes: “If someone guesses your master password, they may gain access to all your accounts.” It describes using multi-factor authentication on the password manager if available. See password managers compared.

Passkeys

Passkeys replace the password with a pair of cryptographic keys: one held by the account provider and one on the person’s device or a FIDO2 security key. ASD describes passkeys as “a faster and more secure way to log in to your online accounts than using passwords”, and says they help “stop cybercriminals from stealing your account password using scams or tricking you to log in to a fake website”. ASD also describes making sure, once a passkey is created, that the ability to log in with a password is disabled. See passkeys explained.

For organisations

ASD’s password spray advisory also lists MFA on all external access systems, complex passwords and a strong password reset policy, increased alerting and monitoring, additional access controls and hardening (such as geo-blocking, controlling IP addresses or requiring a VPN), and resetting credentials of affected accounts. Microsoft’s playbook describes enabling custom banned-password lists in Microsoft Entra ID, which it says “prevents users from setting weak passwords or passwords associated with your organization”.

If an account has been taken over

ASD’s “I’ve been hacked” page lists these steps:

1. Make a record of the key details: what happened, when, whether anyone made contact, and how you responded.
2. Cut off access by disconnecting from the internet and scanning for malware.
3. Change all passwords and passphrases.
4. Tell contacts to watch for “strange links or email attachments”.
5. Report through ReportCyber, and contact the bank or credit union immediately if financial details were stolen.
6. For more help, call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371), which ASD says is staffed 24 hours a day, 7 days a week.

More detail is in what to do if an account is hacked. To check where your own accounts stand, the MFA readiness checklist walks through the main ones.

Things to watch for

• Breach notifications. A notice that a password was exposed is a prompt to change it everywhere it was reused.
• Unexpected MFA prompts. An approval request that wasn’t triggered by the account owner can mean someone has the password.
• “Password expired” emails. These are a common phishing lure.
• Work logins on shared computers. ASD’s infostealer advisory says: “Do not log in to your work accounts from shared or communal workstations.”
• One strong password, everywhere. Even a long password is exposed by reuse.

Common questions

How do hackers get my password?

Usually by obtaining or guessing it rather than breaking the service’s own security. The main routes are credential stuffing (trying passwords leaked in other breaches), password spraying, brute force, fake sign-in pages and malware that copies passwords saved in browsers. Each relies on a predictable habit, such as reusing passwords or typing them into a fake page. See types of password attack.

What is credential stuffing?

It’s when attackers take username-and-password pairs leaked in one breach and automatically try them on other websites. It works because of password reuse: ASD’s ACSC says that if you’ve reused a breached password, other accounts “also may be at risk”. The account being attacked was never breached itself, so a unique password means the stolen pair doesn’t work elsewhere. See credential stuffing.

What’s the difference between password spraying and brute force?

Brute force tries a very large number of passwords against one account or a stolen password file until one works. Password spraying tries a small number of common passwords across many accounts. ASD’s 2019 advisory says attackers may attempt logins based on the expected lockout threshold, staying just under it, which makes spraying hard to spot. See password spraying.

Does MFA stop password attacks?

ASD’s password spray advisory says “MFA is highly effective at mitigating brute force and password spray attacks”, and ASD’s passphrase page calls MFA “one of the most effective ways to protect your accounts from cybercriminals”. ASD’s infostealer advisory also notes stolen session cookies “could effectively bypass MFA requirements”, and describes phishing-resistant MFA as best practice. See multi-factor authentication.

Are passkeys safer than passwords?

ASD describes passkeys as “a faster and more secure way to log in to your online accounts than using passwords”. It says they help stop criminals stealing your password through scams or by tricking you into logging in to a fake website. ASD also describes disabling the ability to log in with a password once a passkey is created. See passkeys and passkeys explained.

What do I do if my account has been hacked?

ASD’s “I’ve been hacked” page lists recording what happened, cutting off access and scanning for malware, changing all passwords and passphrases, and warning contacts about strange links. It also lists reporting through ReportCyber and contacting your bank immediately if financial details were stolen. The 24/7 hotline is 1300 CYBER1 (1300 292 371). See if an account has been taken over.

Where to get official help

• ASD’s ACSC: I’ve been hacked, ReportCyber, and the 24/7 hotline 1300 CYBER1 (1300 292 371).
• ASD’s ACSC: guidance on passkeys, passphrases and password managers.
• IDCARE: 1800 595 160 (individuals), 1800 595 170 (small business).