credentialstuffing

Credential stuffing is a cyberattack in which attackers test large volumes of stolen username-password pairs against online services to gain unauthorized access. It relies on automation and on users reusing credentials across sites. Unlike brute-force guessing, the credentials tested are known to be valid on at least one service.

Attackers obtain credentials from data breaches or leaked dumps and run automated login attempts from many machines or IP addresses. Proxies and botnets help evade rate limits and detection. If a match occurs on a target site, the attacker gains access without knowing the target's password.

Targets include consumer services with high user volumes such as e-commerce, social networks, email, and financial platforms. Impacts include account takeover, unauthorized purchases, data exposure, and reputational damage to the service. The approach can enable further fraud through compromised accounts or through abuse of account recovery processes.

Mitigation combines strong authentication and monitoring. Users should use unique passwords and password managers, and enable multi-factor authentication. On the service side, employ rate limiting, bot and IP reputation checks, device fingerprinting, and risk-based authentication. Credential-monitoring services and breach alerts help detect exposures, while incident response should address compromised accounts and customer notification.