← Back

Block employees from using Weak passwords

Block Weak or Compromised Passwords

Login to Launch Attack Simulation
Attackers use automated tools and credential stuffing attacks to test large databases of leaked or commonly used passwords. Weak or reused passwords make it easy for attackers to gain unauthorized access to systems.
Read More ↓

Defend With SquareX

Create an identity policy to Block weak and compromised passwords

Affected Companies:
Colonial Pipeline
Foundation Software
23Andme
Blogs:
Cracks in the Foundation: Intrusions of FOUNDATION Accounting Software - Huntress One password allowed hackers to disrupt Colonial Pipeline, CEO tells senators - Reuters Genetics firm 23andMe says user data stolen in credential stuffing attack - BleepingComputer

Example Policy

Screenshot for Block Weak or Compromised Passwords

Follow These Steps

  1. Click on Launch Attack Simulation button
  2. Login using password 12345678
  3. With SQRX enabled, login will get blocked

Details

Threat actors exploit organizations' weak password policies and leverage massive databases of compromised credentials from previous data breaches to gain unauthorized access to systems and accounts. This attack vector combines two primary methods: systematic exploitation of weak passwords through automated brute force and dictionary attacks, and credential stuffing using leaked password databases from major breaches. Attackers utilize specialized tools for brute force attacks and custom Python scripts for credential stuffing operations. These attacks exploit human behavioral patterns including password reuse across multiple services, predictable password creation habits (seasonal passwords, company names with numbers), and resistance to complex password requirements.

Impact

Immediate Account Compromise: Successful exploitation provides attackers direct access to user accounts Data Breach Amplification: Weak passwords protecting administrative accounts can lead to organization-wide data breaches affecting millions of customer records, intellectual property, and confidential business information. Financial Theft and Fraud: Compromised accounts enable unauthorized financial transactions, cryptocurrency theft, invoice fraud, payroll manipulation, and identity theft affecting both organizations and individuals.

Indicator of Compromise (IOC)

Brute Force Attack Patterns: High volumes of failed authentication attempts targeting specific accounts, with systematic testing of common password patterns and dictionary words Geographic Anomalies: Successful logins from unusual geographic locations Behavioral Anomalies: Legitimate accounts showing immediate suspicious activity after successful login, including changed passwords, modified settings or unauthorized file access