Security alert: password brute-forcing has been accelerated by AI. How should businesses defend?

A tool called BruteForceAI recently appeared on GitHub and quickly racked up 1.6 thousand stars, according to shares within the cybersecurity community: a Python program that combines a large language model (LLM) with automated password cracking. The signal is clear — both attack and defense have entered the AI era. This article takes a strictly defensive stance: what Vietnamese businesses should do right now so their login pages don't become the open door.

What this tool tells us

Brute-force attacks are as old as the Internet: the attacker tries password after password against a login page until one hits. For years, defending against them was fairly easy: attackers used rigid scripts hammering away in bulk, so a simple rate-based block was enough.

What has changed is the AI layer stacked on top. According to descriptions from the source, this tool uses an LLM to analyze the structure of a login page and correctly identify the input fields by itself — work attackers previously had to do manually for each website. It also mimics the rhythm of a real user's interactions, rotates User-Agent strings (browser identifiers) to avoid bot detection, supports multi-threading, and even has a password spray mode. It's still the same old brute-force attack — just smarter, better automated, better adapted, and harder to distinguish from real users.

The most notable point isn't any single tool: it's clear proof that the technical barrier to organizing an effective password-cracking campaign has dropped sharply. At that point, a business's question is no longer "will anyone target us" but "can our front door withstand automated cracking?"

Two types of password attacks to tell apart — so you can defend against both

• Classic brute-force: trying many passwords against one account. This wins when your password is short, simple, or guessable.
• Password spray: trying a few extremely common passwords (think "Passw0rd!", company name plus birth year...) across thousands of different accounts. This wins when employees use guessable passwords — and since each account is tried only a few times, it slips past lockout mechanisms that set thresholds per account.

These two are defended against by different, complementary layers — no single layer is strong enough to skip the others.

Defense checklist: 5 mandatory layers of protection

1. Strong, unique passwords

The foundational layer is still the most important:

• Length beats complexity: a string of 4 unrelated words is still safer than "P@ss123" — length is what makes cracking expensive.
• Never reuse passwords across systems, especially between personal accounts (email, social media) and company accounts.
• Block common passwords at creation: the system should reject passwords on known-guessable lists, including words related to the company name.
• Consider deploying a password manager for all employees so long, unique passwords become practical instead of a burden.

2. Turn on multi-factor authentication (MFA)

MFA — Multi-Factor Authentication — requires a second proof (a code from an app, a dedicated device, a security key) in addition to the password. This layer offers the highest blocking effectiveness per dollar invested: a password may get cracked, but the attacker still has another barrier to overcome. Absolute priority for administrator accounts, finance accounts, business email, and remote access (VPN, remote desktop). Note: SMS messages are the weaker option compared to authenticator apps or physical security keys.

3. Rate-limit the login endpoint

This is the layer that directly makes a cracking attempt temporally impossible:

• Limit attempts per IP address and per account.
• Progressively increase response delays after each failure: crackers depend on attempt speed — escalating delays stretches a crack from minutes to years.
• Add bot verification (captcha) on subsequent attempts, because the new tool deliberately mimics real users precisely to evade this layer.

4. A controlled account lockout policy

Locking accounts after several consecutive failures is a common measure, but it needs careful design:

• Temporary lockouts with escalating durations rather than permanent locks, so you don't turn yourself into a victim of attacks that weaponize the lockout mechanism itself to disrupt customer accounts.
• Pin on the IP + account combination: one IP trying many different accounts is a sign of password spray — it must be handled at the IP layer, not just the account layer.
• Always balance security against customer experience: lock out too easily, and the fence blocks your own real users.

5. Anomaly monitoring and response

Passive defense isn't enough — you need to see the crack in progress:

Warning sign	What it might be
A burst of failed logins from one IP	Brute-force against one account
A few failures spread across many accounts, from many IPs	Password spray
A successful login right after a streak of failures	An account was just cracked — act immediately
A successful login from an unusual location or hour	An account has been compromised

These signals need to be centralized (centralized logging) with a clear response process: reset the password, revoke sessions, lock the account, notify the user, and log the incident. Alongside that, the system should return a generic error like "incorrect login credentials" rather than revealing which emails exist — denying attackers a list of valid accounts to target.

A perspective for Vietnamese businesses

• Audit every Internet-facing login page now: internal web apps, admin panels, email systems, VPN, remote desktop gateways — especially old, self-built systems that have never had a security review.
• Don't let shared accounts become the back door: shared logins, test accounts, and default device passwords are target number one for password spray.
• MFA for 100% of employees is an achievable goal, not something reserved for large enterprises — most business platforms today support enabling it for free.
• Training that is simple but on point: employees need to understand why passwords must never be reused, and why passwords built from the company name are the first target.

Conclusion

The arrival of AI-assisted password cracking is a reminder with no excuse attached: cyberattacks are getting cheaper, faster, and smarter — while weak login pages remain the first thing every business gets hit on. The good news is that the entire most-effective defensive stack (strong unique passwords, MFA, rate limiting, account lockout, anomaly monitoring) consists of mature techniques that require no cutting-edge technology — only serious implementation and regular review. Don't wait for a strange login notification to appear before starting.

Source: compiled from technical discussions on Facebook, edited by Wotech Electronics.

Does your business need a review of login security, password policy, and monitoring systems? Contact Wotech for a security assessment and advice on an infrastructure hardening roadmap that fits.