Password spraying is an attack in which someone tries a small number of common passwords against many different accounts, instead of trying many passwords against a single account. Spreading the attempts out helps avoid the account lockouts that repeated failures on one account would normally trigger. It tends to work against accounts that use weak or predictable passwords.
Because each account sees only a few failed sign-ins, the activity can be easy to miss if monitoring looks only at failures per account. A better signal is the pattern across the whole service, such as many accounts failing from the same source, or failures spread slowly over a long period. Attackers may also vary their source addresses and timing.
A successful spray yields valid credentials, but what an attacker can do with them depends on what those accounts can reach and whether further protections, such as multi-factor authentication, are in place. Seeing failed sign-ins in the logs does not by itself show that anything was compromised, and a lack of lockouts does not show that nothing was attempted.
To defend against it, require multi-factor authentication, block commonly used and previously breached passwords, apply rate limits on sign-in endpoints, and monitor authentication logs for failures across many accounts from one source. If a spraying attempt is detected, review which accounts may have succeeded and require those users to change their passwords.