Attackers are increasingly using targeted wordlists to guess passwords, and they don’t need artificial intelligence to do it. Instead, they rely on tools like CeWL, which scrape an organization’s public-facing content—such as websites and social media—to generate lists of likely passwords based on the language and terms used by that organization. This approach can be highly effective, as it capitalizes on the tendency of users to create passwords that are familiar or meaningful to them. The article emphasizes that simply having complex password policies is not enough to protect against such attacks, as attackers can easily bypass these measures by using personalized wordlists. Organizations need to be aware of this tactic and take steps to educate their users about creating stronger, more secure passwords.