Credential Stuffing

Attackers exploit password reuse: a credential pair exposed in one breach may also unlock an unrelated account. Unlike password guessing or brute-force cracking, credential stuffing starts with an existing list of compromised credentials. Automated login attempts can lead to account takeover, fraud and unauthorized access even when the target service itself has not leaked its users’ passwords.

Defenses include multifactor authentication, detection of suspicious authentication patterns, credential-breach checks, rate controls and encouraging unique passwords through password managers. Blocking large volumes of requests must be balanced against legitimate users and accessibility needs. The precise defense mix depends on the service and threat model.

Credential stuffing is not keyword stuffing, and it is different from a password-spraying attack in which an adversary tries a small set of guessed passwords against many accounts. A business should treat recurring suspicious login attempts as a security investigation, not as proof that a specific account has been compromised.