How credential stuffing works

  1. Attackers collect email and password pairs from breaches, combolists and stealer logs.
  2. They load the lists into automated tools that send login attempts to target sites, often through large proxy networks so the traffic looks like it comes from many ordinary users.
  3. Successful logins are checked for value, such as stored payment cards, loyalty points or corporate access, then sold or used directly.

Credential stuffing vs brute force

A brute force attack guesses many passwords for one account. Credential stuffing tries one known password for many accounts. That makes it quieter, harder to detect with simple lockout rules and far more efficient, because each attempt uses a password that someone actually chose.

How to defend against it

  • Enforce multi-factor authentication, especially on email, VPN and admin accounts.
  • Check new and existing passwords against known breached passwords.
  • Detect unusual login patterns, such as many failed logins across different accounts from rotating IP addresses.
  • Monitor for your organisation's credentials appearing in leaks so you can reset them first.

How DarkInvader helps

DarkInvader's Leaked Credentials monitoring finds your staff and customer credentials in breach data, combolists and stealer logs, using the Darchive database of more than 23 billion records, so you can force resets before they are used for credential stuffing.

Explore Leaked Credentials

Frequently asked questions

Why does credential stuffing work?

Because people reuse the same password across sites. When one site is breached, every other account with the same email and password becomes vulnerable.

Does multi-factor authentication stop credential stuffing?

Largely, yes. A correct password alone is no longer enough to log in. Attackers then need to phish or bypass the second factor, which is much harder at scale.

How can I tell if we are being credential stuffed?

Look for spikes in failed logins spread across many accounts, logins from unusual locations or proxy networks, and successful logins followed by quick changes to account details.

Related terms and reading

Sources