Credential Stuffing
An attack that replays username and password pairs leaked from other breaches against a target, exploiting password reuse. Defended with MFA, passkeys, and bot detection.
Credential stuffing works because password reuse is near-universal and the attacker's cost per attempt is close to zero. Rate limiting alone loses: modern kits distribute across residential proxies at low volume per IP. What actually breaks the economics is removing the reusable secret, which is why passkey rollouts show sharp drops in stuffing success, and detecting the pattern at the population level rather than per account.
See also: account takeover, password spraying, phishing-resistant MFA, Snowflake 2024 credential attacks, password manager
Related on Start with Identity
- GlossaryAdversary-in-the-Middle (AitM)
Adversary-in-the-middle (AitM, written AiTM by MITRE) is an attack in which the attacker positions itself between two parties, such as a user and a sign-in serv
- GlossaryBrowser-in-the-Browser (BitB)
Browser-in-the-browser (BitB) is a phishing technique in which a web page draws a fake browser popup window, complete with title bar, address bar and padlock, o
- GlossaryInfostealer
Malware that harvests credentials, cookies, and session tokens from infected devices, then sells them. A major driver of recent account-takeover and session-the
- BlogChick-fil-A's second credential stuffing breach in three years hit 13,322 loyalty accounts
Automated login attempts using credentials obtained from a third-party source, not a Chick-fil-A breach, compromised 13,322 Chick-fil-A One loyalty accounts ove
- TechniqueCredential stuffing
Attackers replay username and password pairs leaked from one breach against every other login page they can reach, betting on the well-documented habit of passw
- Blog1Password buys Apono, moving from credential vault to access control plane
Reported at 250 to 300 million dollars, the deal gives 1Password just-in-time privileged access across AWS, Azure, GCP, Kubernetes, Snowflake, and Databricks, a