Password spraying is a kind of brute force attack that tries to apply common passwords to various accounts. By doing this, these attacks avoid most lockout policies. Usually, password spraying is used against sites with SSO or apps that use federated authentication.
To avoid password spraying, use multi-factor authentication.