Credential Stuffing

Credential stuffing replays credentials leaked from other sites against your login. Because people reuse passwords, a small percentage always works — and attackers automate millions of attempts.

How it works

The attacker loads combo lists (email:password pairs from prior breaches) into tooling that distributes requests across proxies and rotates user agents to evade simple blocks. Even a 0.1% success rate over a 10-million-credential list is 10,000 compromised accounts. Distinct error messages and missing rate limits make it cheaper.

How to test

Confirm whether the login distinguishes "user not found" from "wrong password" (enumeration), whether failed attempts are rate-limited per account and per IP, and whether breached passwords are rejected.

Impact

Mass account takeover, fraud, and downstream phishing from trusted accounts.

Defenses

• MFA — the single most effective control.
• Rate-limit and lock by account and source; deploy bot detection.
• Check new/changed passwords against breach corpora (k-anonymity APIs); standardize generic login errors.