"It said real adversaries may have instead used prolonged password-praying attacks rather than phishing at this stage"
Did the author mistype Password-Spraying or is there a seperate type of attack known as Password-Praying? Googling doesn't reveal any other hits on this term.