Huntress reported a 155x increase in password spraying attacks during H1 2026. The attackers leveraged legacy authentication protocols and gaps in MFA implementations that left certain login paths unprotected, enabling large-scale brute force attempts. A notable campaign involved more than 81 million login attempts over a two-week period. This surge underscores the importance of comprehensive MFA coverage and the deprecation of legacy authentication mechanisms to reduce attack surfaces.

The increased volume of password spraying attacks raises the likelihood of unauthorized access where MFA is incomplete or legacy authentication is enabled. Attackers can potentially compromise accounts by exploiting these gaps, leading to credential theft or unauthorized system access. However, no specific exploits or breaches are reported in the data provided.

Organizations should ensure full coverage of multi-factor authentication across all login flows and eliminate or restrict legacy authentication protocols. Reviewing and tightening MFA policies to cover all access points is critical to mitigating this threat. Since no patch or vendor advisory is provided, follow best practices for MFA deployment and legacy protocol deprecation.