Credential Stuffing
Also known as: Credential-stuffing attack
Credential stuffing is an automated attack that takes username/password pairs leaked from one source and tries them en masse against other services, exploiting password reuse to take over accounts. It is fuelled by the huge volume of credentials exposed through breaches and infostealers.
What is credential stuffing?
Credential stuffing uses automation to test large lists of stolen username/password combinations against login forms across many websites. Because people frequently reuse passwords, a fraction of these attempts succeed, handing attackers working logins without any password guessing.
Why credential stuffing works
The attack is effective for two reasons: the sheer supply of leaked credentials (from breaches, combolists, and stealer logs) and widespread password reuse. Attackers use bots, proxy networks, and anti-detection tooling to evade rate limits and blend in with normal traffic.
Defending against credential stuffing
Defences include phishing-resistant MFA, detecting and blocking automated login patterns, monitoring for credentials exposed in stealer logs and breaches, and encouraging unique passwords via password managers.
VantaPrism helps cut off credential stuffing at the source by alerting organisations when their users' credentials appear in infostealer logs, so those passwords can be reset before they enter attackers' combolists.
Check Your Exposure arrow_forwardFrequently Asked Questions
How is credential stuffing different from brute forcing?
What is the best defence against credential stuffing?
Related Terms
Compromised credentials are usernames and passwords that have been exposed to unauthorized parties — frequently throu…
Account takeover (ATO) is when an attacker gains unauthorized control of a legitimate user account, typically using s…
A combolist is a compiled list of username/email and password combinations, aggregated from breaches and stealer logs…
Credential theft is the act of stealing authentication data — usernames, passwords, tokens, and session cookies — so…
A stealer log is the package of data exfiltrated from a single device by infostealer malware. It typically contains s…