Credential Stuffing
Credential stuffing replays username-password pairs leaked from other breaches against your login, succeeding wherever users reuse passwords, at bot scale and behind residential proxies.
Definition
Credential stuffing is automated replay of breached credentials against a target login. Unlike brute force, guesses are known-good passwords from other sites, so success rates track password reuse — single-digit percent of attempts, still thousands of accounts. Attacks distribute across IP ranges and pace requests to evade naive rate limits.
Context and scope
Drives breached-password checks, MFA adoption, adaptive rate limiting, and bot management on any consumer login surface.
Common misconceptions
- Rate limiting per IP stops it — residential proxy pools and distributed bots make per-IP limits mostly noise
- Password complexity rules defend against stuffing — reuse, not weakness, is what stuffing exploits; breached-password screening matters more
- Failed-login alerts to users are pointless — they measurably reduce successful account takeover follow-through when paired with forced resets
Anti-patterns
- Throttling only by IP and账号, letting botnets spread attempts below both thresholds
- Blocking breached passwords in words but permitting them at reset, reopening the same hole
- Alerting on every failure and training users to ignore the flood of notifications
Related concepts
Related examples
Authoritative source
What it is
Billions of leaked credentials circulate. Attackers spray them at every popular login; a small overlap of reused passwords yields real accounts. The traffic looks like distributed normal users failing once each, which is precisely what per-account lockouts and per-IP limits tolerate.
How it works
Botnets and proxy services rotate source addresses. Attempts are paced to sit under thresholds and target email-plus-password pairs from combolists. Post-compromise monetization follows: email pivot, stored payment abuse, or resale. Defense stacks breached-password screening at set and reset, MFA, device and behavioral signals, and aggregate velocity detection.
When to defend
Any consumer-facing login. Check candidate passwords against k-anonymity breached-password APIs so plaintext never leaves; make MFA the default with phishing-resistant factors where possible; monitor login success rate by cohort.
Pitfalls
Aggressive lockouts become a denial-of-service weapon against known emails. Success-rate anomaly detection beats absolute failure counts — baseline per-tenant and per-channel. Reset flows are part of the attack surface: stuffing feeds automated password spraying into reset tokens too.