You mean, that people use passwords like "abc123" and hash them to SHA-256 to get "6ca13d52ca70c883e0f0bb101e425a89e8624de51db2d2392593af6a84118090".
And then they think that the second is more secure than "abc123".
But is it?
Yes, the hashed version is in some cases more secure when we're talking about password-entropy. Because it's longer, has more random digits and characters,...
However, this is something we call security through obscurity.
This method is secure, as long as no one knows you're using this.
Because, it actually is just a case of hashing weak words to SHA-256 and see if they match.
Password crackers when doing a dictionary attack define rules.
This can be things like: "also try with '123' after every word in the dictionary", or "make the first letter of the words in the dictionary uppercase", but they can also be "SHA-256 hash every word in the dictionary and try that".
And that rule is probably what this password attacker used.
And yes, SHA-256 is relatively slow (which is a good thing), so the attacker would need more and better hardware. But people do have dedicated computer systems with e.g four top-level Nvidia Titan GPU's.
Which can still do a lot of MD5(SHA-256($pass)) tries in a given amount of time.
And not to mention that botnets are also still a thing, combining loads of computers to have more power.
tl;dr:
It's just a question of using good rules.
And maybe only SHA-256 the words which are short/weak, instead of all to save time.
Tip for using save passwords:
Take e.g five easy to remember words:
e.g: battery, lamp, living room, candle, firespeed.
(The battery of my lamp was empty so I took the candle in my living room with firespeed).
This way, your password is:
batterylamplivin_groomcandlefirespeed
This way you have +- 35 characters, we have putted in a random '_'
in the middle of a word to make it a lot harder for the attacker to guess.
And when the attacker is doing a dictionary attack with rules of combining words. He'd need to combine this five word in the right order, including a word like 'firespeed', and then a rule to place a _ in every place of the string.
With other words, this is a strong password, easy to remember and easy to type.
A password manager is still better, but the password above could be used as masterpassword for the manager.
Tips for saving passwords in a database:
Use strong algorithms like SHA-256, but even better: Bcrypt.
Read papers on how to salt and even pepper,
let your code be reviewed by several people before actually using,
don't try to make own algorithms.
