CyberGlossary

Attacks & Threats

Credential Stuffing

Also known as: Credential replay, Account checking

Definition

An automated attack that replays large lists of username/password pairs leaked from one service against other services, exploiting password reuse to take over accounts.

Credential stuffing leverages enormous combolists of credentials stolen in past breaches. Attackers feed these lists through automation frameworks (Sentry MBA, OpenBullet, Snipr, custom scripts) that rotate residential proxies, solve CAPTCHAs, and pace requests to evade rate limits. Because many users reuse passwords across sites, even a low success rate (often 0.1–2 %) produces large volumes of takeovers, which are then monetised through fraud, gift-card cashout, or onward credential resale. Defences include MFA (ideally phishing-resistant FIDO2/passkeys), breached-password screening, device fingerprinting, bot management, anomaly detection on login, and progressive throttling.

Examples

  • Bots logging into a streaming service with combolists from unrelated forum breaches to resell working accounts.
  • A retailer seeing a spike of logins from residential IPs across thousands of accounts after a third-party leak.

Related terms