The '--' sequence is often used in SQL injection attacks because it acts as a comment delimiter in SQL. This character sequence tells the SQL engine to ignore the rest of the line, which can be exploited by attackers to bypass certain security measures or manipulate queries.