Iran targets M365 accounts with password-spraying attacks

[Wonder Why]

4. People who have "the same commonly used or likely password".

Instead of hitting one account with multiple attempts to try different passwords to crack it, which would cause the account to be locked because of multiple failures, they try one common password like the word "password" on zillions of different accounts to find the idiots that were that stupid. Such people are just begging to get hacked.

You'd be amazed at the number of people that just use successive keys (qwerty) on keyboard or Password123 which has upper/lower case and numbers but is all too common e.g.

When you have an account that is open to the internet, anyone can try a simple password on it and if 1 billion people have a Microsoft 365, one try on each of those billion by a computer program, is bound to find the idiots in no time at all.