An authentication attack that tries one common password across a large list of accounts — the opposite of brute force (many passwords against one account). Because each account sees only a single attempt, it avoids lockout and stays low-noise.
Typical candidates: seasonal passwords (Winter2026!), default onboarding passwords, CompanyName123!. Primary defense: MFA and spray-pattern detection.