Bottom line: Huntress reports a 155-fold increase in password spraying attacks in H1 2026, specifically exploiting legacy authentication and gaps in MFA policies.
Security vendor Huntress recorded a 155-fold increase in password spraying attacks in the first half of 2026. A single campaign generated more than 81 million login attempts within two weeks.
According to Huntress, the observed attacks specifically exploited outdated authentication methods (legacy authentication) as well as gaps in multi-factor authentication (MFA) policies. Certain login flows remained unprotected because they were not fully integrated into MFA enforcement. The campaign mentioned, with more than 81 million login attempts within two weeks, illustrates the scale of automated, distributed attack attempts against login systems.
For CISOs, the finding is relevant because it addresses a known but often underestimated weak point: legacy protocols such as POP, IMAP, or older SMTP-Auth implementations often do not support modern authentication and thereby become a workaround for MFA requirements. If such protocols are not explicitly blocked or restricted in identity and access management policies, an entry point remains — regardless of how consistently MFA is enforced for the primary login interfaces.
From a practical standpoint, this creates the need to inventory all authentication paths of a directory service or identity provider and check whether legacy protocols can be disabled. Where complete deactivation is not possible, conditional access policies, IP restrictions, and anomaly detection for unusual login patterns — such as high failure rates across many accounts — should be deployed as additional measures. The reported scale of the attacks further underscores the need for monitoring capabilities that can reliably detect mass, low-threshold login attempts over an extended period.
Source: www.bleepingcomputer.com · Published August 19, 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.