An attacker slowly tries the single password Summer2024! against 50,000 different accounts to stay under per-account limits. What is this called?

This is password spraying. It tries a few common passwords across many accounts. Each account sees very few attempts, so per-account lockouts never trigger.

"Credential stuffing" is close but different. It replays specific username and password pairs leaked from other breaches. Here the attacker uses one guessed password for everyone, not leaked pairs.

To detect spraying, you need global signals, such as the failure rate across all accounts.