Most businesses picture a hacker as someone who targets them personally. The more common reality is far less personal: automated tools working through lists of business email addresses, trying a handful of popular passwords on each one, from servers in countries those businesses have never dealt with.
This is called password spraying. Business email addresses are easy to find on websites, letterheads and LinkedIn, so any business on Microsoft 365 can end up on such a list. The real question is whether anyone notices when one of those guesses comes close.
What happened, and how it works
Microsoft describes password spraying as an attack where, instead of trying many passwords on one account, the attacker tries a small set of commonly used passwords against many accounts. One guess per account, spread slowly across a whole business, stays under the radar of the lockout rules that stop someone hammering a single account.
It works because somewhere in most organisations there is a password like a season and a year, or the company name with a number on the end. Microsoft notes that attackers use automated tools for this, and that sign-ins using old email protocols such as POP3 and IMAP can be a sign of a spray, because those older methods can skip the second check that MFA (multi-factor authentication: a code or app prompt after the password) adds.
Why it matters to a business like yours
One correct guess is enough. Microsoft's own investigation guidance lists what typically follows a successful spray:
- MFA fatigue: the attacker has the password and keeps triggering sign-in prompts, hoping someone taps "Approve" to make them stop.
- Inbox rules and forwarding: quietly copying mail to an outside address, or hiding replies, which is how invoice fraud and fake banking detail changes begin.
- Internal phishing: sending convincing emails from a real colleague's account to staff, clients and suppliers.
For a South African business, a mailbox full of client correspondence is also personal information under POPIA, so a compromised account is not just an IT problem. It can become a security compromise you have to report.
What to do now
You don't need to be technical to ask your IT people these questions:
- Is MFA switched on for every account, including admin accounts, shared mailboxes people sign in to, and that one account "we never got round to"?
- Are old sign-in methods blocked? If POP3, IMAP or other legacy sign-ins are still allowed, MFA can be skipped.
- Does anyone look at failed sign-ins? Microsoft records them. Someone should be checking where they come from.
- Are inbox forwarding rules to outside addresses checked? They are a common first move after a break-in.
- Are passwords long and unique? A passphrase beats a word with a number on the end.
How you would know
This is exactly the gap Vikelus was built to close for F1 IT Solutions' clients. It checks Microsoft 365 sign-ins every 10 minutes and keeps every failed attempt, and every attempt from abroad, with its country, approximate city and network owner. So F1's team can see not just that an account is being tried, but from where in the world.
When the pattern looks like a spray, such as many accounts being tried from the same foreign country, it is flagged. When it gets serious, for example a correct password stopped only by MFA from a country you don't work in, or a successful sign-in from one, F1's team is alerted by email, usually within minutes, and a technician looks into it and acts.
The daily checks catch the follow-on moves too: accounts without MFA, old sign-in methods left open, and inbox rules forwarding mail outside the business. Vikelus only reads; it never changes your settings. F1's technicians fix what it finds, and Vikelus checks the fix worked. Each month you get a plain-language report on what was found and fixed.
Vikelus is part of how F1 IT Solutions looks after its clients. If you would like to see what it would watch for your business, book a 20-minute walkthrough.
