Credential stuffing

Credential stuffing is catalogued as MITRE ATT&CK T1110.004 and as OWASP Automated Threat OAT-008, distinct from credential cracking (OAT-007). The input is a combolist: millions of email/password or username/password pairs harvested from earlier breaches, infostealer logs and phishing kits, deduplicated and traded or leaked. Tooling such as configurable "checker" frameworks replays each pair against a target's login endpoint or its underlying API, parses the response to tell success from failure, and saves working accounts ("hits") for resale or takeover. Per-attempt success rates are low, but at millions of attempts even a small fraction yields thousands of accounts.

The engineering effort goes into evasion. Requests are spread across large pools of residential and mobile proxies so that no single IP address stands out, user agents and TLS fingerprints are rotated or copied from real browsers, headless browsers execute JavaScript challenges, and CAPTCHAs are passed to human or automated solving services. Attackers often prefer mobile or legacy API endpoints, which tend to have weaker bot controls than the web login form. This is why per-IP rate limiting alone rarely stops a competent campaign.

It differs from its neighbours in how the guess is chosen. Classic brute force (T1110.001, password guessing) tries many passwords against one account; password spraying (T1110.003) tries a few common passwords against many accounts to stay under lockout thresholds; credential stuffing tries one known password per account, so account lockout barely triggers. Session hijacking skips authentication entirely by stealing an already issued session token, which is also how infostealer-driven attacks sidestep a password change.

Defences work in layers. NIST SP 800-63B-4 §3.1.1.2 requires verifiers to compare new passwords against a blocklist that may include breach corpuses; services such as Have I Been Pwned's Pwned Passwords expose this through a k-anonymity range API, where only the first five hex characters of the SHA-1 hash leave the client. At login, detection relies on signals such as a spike in failed logins across many distinct accounts, high rates of unknown usernames, device fingerprinting and impossible-travel checks, with step-up challenges instead of hard blocks. MFA removes most of the value of a reused password, and phishing-resistant authenticators such as passkeys (FIDO2/WebAuthn) remove the shared secret altogether. A successful stuffing attack against personal data can still be a personal data breach under GDPR Art. 33 even though the service itself was never "hacked".