Credential stuffing is an automated attack that tries username and password pairs stolen from one breach on many other sites, hoping people reused them. It works because of password reuse, not weak passwords. Detection relies on login-pattern signals across the whole platform. Defense combines enforced MFA, rate limits, bot controls and monitoring for exposed credentials.
Your password policy is strong. You enforce complexity requirements, rotation intervals, and lockout thresholds. Your users have been told (repeatedly) not to reuse passwords. None of this matters if someone is already selling your employees’ credentials on a dark web forum for next to nothing.
Credential stuffing is not a hacking technique. It is a logistics operation. Attackers do not guess or crack passwords. They buy lists of real username-and-password combinations harvested from previous breaches. Then they automate testing those combinations across hundreds of target services at once. The only technical skill required is the ability to run a script. The only investment required is a dark web marketplace account.
Compromised credentials are one of the most common ways attackers get in. MITRE ATT&CK tracks credential stuffing as its own technique. Huge aggregated collections of login credentials, compiled largely from infostealer malware logs, have turned up freely accessible online.
At a glance
- What it is: automated testing of stolen login pairs against other services.
- Why it works: people reuse passwords, and attackers buy fresh lists of real pairs cheaply.
- How to spot it: look for patterns across all logins, because each account sees only one failure. The detection section below lists the signals.
- What to do: enforce MFA at login, add bot controls, check passwords against breached lists and watch for your own credentials in leaked data.
What Is Credential Stuffing?
Credential stuffing is an automated cyberattack. Threat actors take large collections of stolen username-and-password pairs, called combolists. They then test them against online services, applications, and enterprise portals. The attack is built on a single behavioral fact: most users reuse passwords across multiple services. For a short definition, see the credential stuffing glossary entry.
MITRE ATT&CK notes that adversaries take advantage of the tendency of users to use the same passwords across personal and business accounts. This means that stolen credentials from one platform can also unlock a user’s account on a completely different platform. In a database of hundreds of millions of pairs, even a very low success rate means many compromised accounts.
How Is Credential Stuffing Different from Brute Force and Password Spraying?
| Brute Force | Credential Stuffing | |
| What is tested | Generated password guesses | Real stolen username + password pairs |
| Skill required | Moderate, wordlist generation, hashcat | Low, run a script, buy a list |
| Detection signal | High many failed attempts per account | Low, one attempt per account, per service |
| MFA stops it? | Usually yes | Partially, depends on MFA type |
| Attack scale | Single target, high volume | Thousands of targets, one attempt each |
| Cost to attacker | Time + compute | Low, combolists are sold cheaply on dark web markets |
| Success driver | Weak passwords | Password reuse |
OWASP separates three related attacks. Brute force tests many passwords against a single account. Credential stuffing tests username and password pairs obtained from the breach of another site. Password spraying tests a single weak password against a large number of different accounts. The defenses overlap, and enforced MFA helps against all three. For the full comparison, including account takeover, read account takeover vs credential stuffing.
Where Do the Credentials Come From? The Supply Chain Behind Every Attack
Credential stuffing attacks do not begin with the attack itself. They begin with the supply chain that produces the credential lists. It is a multi-tier criminal ecosystem, as structured and commercialized as any legitimate software industry.
Tier 1: Infostealer Malware — The Primary Harvest Engine
The dominant source of fresh credentials in 2025 is infostealer malware. Families such as LummaC2, RedLine, Vidar, and Raccoon are deployed on victim devices, typically via phishing emails, malicious downloads, or trojanized software. They silently extract every saved credential from the browser’s local storage, along with session cookies, autofill data, and cryptocurrency wallet information.
The extracted data is packaged into structured log files and transmitted to attacker-controlled infrastructure within minutes of infection. These logs contain not just passwords, but the exact URLs where each credential was used. That makes it easy to sort the harvest by service type. Sellers can then ask premium prices from buyers who want access to a specific platform.
Infostealer malware harvests credentials at very large scale. The scale is not accidental. Infostealer operations are offered as Malware-as-a-Service (MaaS), with low-cost subscriptions on dark web forums. This lets operators with no malware development skills run large-scale credential harvesting campaigns.
Tier 2: Historical Breach Databases – The Long Tail of Past Incidents
Every major data breach that has ever exposed usernames and passwords eventually makes its way into aggregated credential databases distributed across dark web forums. These databases are compiled, deduplicated, and sorted. Then they are sold, traded, and shared across the criminal ecosystem for years after the original breach.
Aggregated databases built from countless prior breaches circulate actively in credential stuffing communities, and they are a core source of leaked credentials. Some compilations combine many separate datasets. They have been found openly accessible online. They include passwords for accounts at major platforms and government services, and they are a ready blueprint for industrial-scale credential stuffing.
| ⚠️ The Dormant Credential Problem Not all credential-based breaches happen immediately after theft. In March 2025, a threat actor leaked 270,000 customer support tickets from a major electronics manufacturer’s German operations. The leak was traced back to a credential compromise from 2021. The credential had sat dormant for four years before being used. Organizations that assume past breaches are resolved are operating with a false sense of security. |
Tier 3: Combolist Marketplaces – Where Credentials Become Commodities
Between infostealer operators and the attackers who run credential stuffing campaigns sits a structured marketplace layer. Combolists are files of email:password pairs sorted by service type, geography, or account value. They are actively bought and sold on dark web forums and Telegram channels. For what the app does and does not protect, see Is Telegram safe? Pricing follows a clear economic logic: freshness and validity rate determine price.
Fresh lists built from recent infostealer logs sell for much more. The credentials have not yet been rotated, so more of them still work. Aged database dumps from historical breaches are cheaper. They still pay off, given the volume available and the low cost of automated testing tools. A combolist of 10 million credentials for a specific streaming platform or e-commerce site can sell very cheaply.
- Infostealer malwareExtracts saved credentials from victim devices
- Historical breach databasesCompiled, sorted and sold for years after the breach
- Combolist marketplacesPrice follows freshness and validity rate
How Does a Credential Stuffing Attack Work? The Technical Anatomy
From the attacker’s perspective, a credential stuffing campaign is a data pipeline problem. How do you test millions of credential pairs against a target as fast as possible, while evading the defenses built to stop you?
Step 1: List Acquisition and Preprocessing
The attacker acquires a combolist relevant to their target. They either purchase it from a dark web marketplace, extract it from a fresh infostealer log, or assemble it from public breach databases. The list is then preprocessed. Duplicate pairs are removed and the format is normalized to the tool’s needs, typically email:password or username:password. It may also be filtered by domain to target users of one service.
Step 2: Tool Configuration and Proxy Setup
The attacker configures an automated credential testing tool. Commercial tools built for penetration testing are often repurposed. The criminal ecosystem also offers dedicated credential stuffing tools tuned for specific platforms. The most critical configuration element is the proxy network: residential or datacenter proxies spread login attempts across thousands of IP addresses. This keeps rate limits and IP blocks from interrupting the attack.
Modern credential stuffing tools are engineered to mimic legitimate browser behavior: they rotate user-agent strings and simulate mouse movement. They also solve CAPTCHA challenges through CAPTCHA-solving services, human-powered or AI-based, which are sold in the same criminal ecosystem.
Step 3: Execution – One Attempt Per Account, Across Thousands of Services
The attack executes at scale. Each credential pair is tested once against the target service. This deliberate throttling (one attempt per account) is the key detection evasion technique.
Traditional brute-force detection looks for many failed login attempts against a single account. Credential stuffing distributes the attempts. Each account sees only one failed attempt, from a different IP address, with a legitimate-looking browser signature. The UK NCSC describes credential stuffing attempts against firewall and VPN portals in Fortinet device credential exposure.
On a typical enterprise SSO or consumer platform, many login attempts can be automated tests of stolen credentials, not real users. Most of these attempts fail and leave no meaningful alert.
Step 4: Hit Validation and Account Monetization
When a credential pair successfully authenticates, the tool logs the ‘hit’ and the attacker begins the monetization phase.
Valid credentials are sorted by account type and value. Financial accounts, corporate SSO sessions, and e-commerce accounts with stored payment methods command the highest prices. They are also acted on most rapidly. The gap between a successful hit and the fraud or resale of the account is often only hours.
- Get the listBuy, extract or assemble a combolist, then remove duplicates
- Set up the toolConfigure the testing tool and use proxies to spread attempts across many IPs
- Run the testTest each pair once per account, so no single account shows many failures
- Cash in the hitsLog valid pairs, sort by account value and act, often within hours
| 💡 Why Detection Is So Difficult A credential stuffing attack, from the target platform’s perspective, looks like a large number of failed login attempts. Each failure comes from a different IP address, uses a different user-agent, and targets a different user account. No individual account triggers lockout. No individual IP exceeds rate limits. The attack is statistically invisible unless you are analyzing authentication patterns at the platform level rather than the account level. |
2025 Case Studies: What Credential Stuffing Actually Costs
CASE STUDY 1 — March 2025 // Financial Sector // Coordinated Multi-Target Attack
Australian Retirement Funds: AUD 500,000 Stolen in a Single Weekend
On March 29-30, 2025, attackers launched coordinated credential stuffing attacks against five major Australian retirement fund platforms simultaneously. The attacks hit the funds in parallel, which left little time for one fund to warn the others.
The attackers used combolists assembled from prior, unrelated breaches credentials that had nothing to do with the targeted retirement funds.
They worked because the fund members had reused passwords from other services. One of the funds did not offer MFA on its member web login; it required MFA only for withdrawals. In June 2025 the prudential regulator, APRA, wrote to all super fund boards. It said the attacks reinforced its concerns about weak authentication controls.
Four members of that fund lost a combined AUD 500,000. Approximately 8,000 members of another fund had personal data accessed. The attack required no technical sophistication beyond the ability to run a credential stuffing tool against the target platforms. The entry cost (a combolist of Australian financial service credentials) would have been a fraction of the stolen amount.
| 5 Superannuation funds targeted simultaneously in a single 48-hour window | AUD 500K stolen from confirmed compromised accounts in the initial attack | 8,000 members of one fund with personal data accessed |
💡 Key Lesson — Unforced MFA Is Not Protection MFA that users can opt out of, or that is not enforced at login, provides no protection against credential stuffing. Attackers know which platforms enforce MFA at login and which make it optional. Optional MFA translates directly to a larger pool of attackable accounts in every combolist that covers that platform.
CASE STUDY 2 — April 2025 // Retail Sector // Repeat Targeting
A Global Apparel Group: Fourth Credential Stuffing Incident Since 2020
On April 23, 2025, the group found a new credential stuffing attack against one of its online stores and later notified affected customers. The attackers used previously leaked credentials (not credentials stolen directly from the company) to access customer accounts. The exposed personal data included names, email addresses, shipping addresses, phone numbers, purchase history, and dates of birth.
This was the fourth credential stuffing incident affecting the group’s brands since 2020. The pattern shows a structural problem. Organizations that do not enforce mandatory MFA, and do not monitor for their customers’ credentials in combolists, will face repeat attacks. Each successful campaign against a consumer brand validates the combolist and drives further attacks against the same target.
| 🔴 The Repeat Attack Problem When a credential stuffing attack succeeds against a specific brand, that success is noted in criminal forums. The combolist gets updated with confirmed hits. The tool config for that platform gets refined and shared. Then different actors, who buy the validated subset of the combolist, often repeat the attack. Organizations that do not structurally address the root causes after a first incident should expect a second, third, and fourth attack. |
How to Detect Credential Stuffing in Progress
Credential stuffing is built to slip past per-account alerts, so detection means analyzing the whole platform. The scale is real. Verizon’s 2025 Data Breach Investigations Report research found that credential stuffing made up a median 19% of all daily authentication attempts. The share reached 25% at enterprise-sized companies and 12% at small businesses.
The signals below turn up in ordinary authentication and web logs. No single one proves an attack, so alert on several together.
| Signal | What you see | Where to look |
| Platform-wide failure rate | Failed logins rise well above the normal baseline, while each account shows only one failure | Aggregated authentication logs |
| One attempt per account | Many accounts each get a single failed login, then some succeed on the first try | Per-account login history |
| Hosting and proxy sources | Logins from data center ranges or known proxy networks, or one IP trying many accounts | IP intelligence and ASN data |
| Scripted volume | Large login volume from a single IP or subnet, with no human pauses | Web server and bot-management logs |
| Abnormal CAPTCHA solve rate | Solve rates far above normal, which can point to automated CAPTCHA breaking | CAPTCHA and challenge metrics |
Authentication Log Anomalies
The most reliable in-platform signal for credential stuffing is a statistical anomaly in authentication failure patterns. A credential stuffing attack will push the platform-wide failure rate well above its normal baseline. This signal requires aggregated authentication analytics, not per-account alerting.
Geographic and ASN Velocity Anomalies
Even with proxy rotation, credential stuffing campaigns leave fingerprints in the distribution of authentication source IP addresses. An attack using a datacenter proxy network will show login attempts from data center ASNs. The volume will be out of proportion to legitimate user traffic from those locations. Residential proxy networks are harder to distinguish, but still produce geographic velocity patterns that diverge from the platform’s normal user distribution.
Dark Web Credential Monitoring – The Proactive Layer
The most actionable detection approach is monitoring for your organization’s credentials in combolists and stealer logs, before attackers use them. When a combolist targeting your platform is shared on dark web forums, there is typically a window of hours to days before the campaign runs.
Organizations with continuous dark web monitoring and leaked credential monitoring can see their users’ credentials appear. They can force password resets and enforce MFA before the stuffing campaign runs.
| 🔍 The Remediation Gap Leaked credentials often stay valid long after exposure because organizations are slow to revoke or rotate them. For dark web combolist exposure, the gap is often even longer because most organizations have no visibility into their credentials’ appearance in criminal markets. Brandefense closes this gap with continuous monitoring and real-time alerting. |
How to Defend Against Credential Stuffing – A Practical Checklist
No single control eliminates credential stuffing. The attack’s success depends on a combination of password reuse behavior, platform authentication design, and the absence of credential exposure visibility. Effective defense addresses all three layers.
| PLATFORM AUTHENTICATION CONTROLS | |
| ✓ | Enforce MFA at login, not as an optional feature. Optional MFA is equivalent to no MFA from a credential stuffing perspective. FIDO2/hardware keys are the most resistant; SMS-based OTP remains vulnerable to real-time interception. |
| ✓ | Implement bot detection and behavioral analytics on your authentication endpoint. Analyze authentication velocity, ASN distribution, user-agent patterns, and failure rates at the platform level rather than the account level. |
| ✓ | Deploy CAPTCHA on login flows. It is not impenetrable, but it raises the cost of automated testing. It also stops simpler tools that cannot solve CAPTCHAs. |
| ✓ | Implement breached password detection check submitted credentials against known breach databases at login and force reset when a match is found. Microsoft and Google provide this natively; third-party services exist for custom implementations. |
| CREDENTIAL INTELLIGENCE AND MONITORING | |
| ✓ | Monitor dark web combolist marketplaces and stealer log distributions continuously for your organization’s domain credentials. These include employee accounts, service accounts, and customer credentials on your platform’s domain. |
| ✓ | Establish credential rotation workflows triggered by dark web exposure alerts when your credentials appear in a combolist. Start forced resets within hours, not weeks. |
| ✓ | Monitor infostealer log feeds for device infections within your organization. A device running an infostealer will exfiltrate every saved credential in the browser, including corporate SSO, email, and cloud platform logins. |
| ✓ | Track combolist mentions of your brand or platform on criminal forums. Watch for a new config file for your platform or a targeted combolist. You want to know before the campaign runs. |
| USER BEHAVIOR AND IDENTITY HYGIENE | |
| ✓ | Enforce unique password requirements Many users reuse passwords across services. Password managers reduce the friction of unique passwords to near zero; mandate their use for corporate accounts. |
| ✓ | Conduct regular credential hygiene awareness the technical controls are defeated by password reuse. Users change behavior more reliably when they know their old breach exposure is being tested against their current accounts. Abstract security training works less well. |
| ✓ | Implement privileged account separation corporate administrator and service account credentials should never share passwords with any external service. These accounts are the highest-value targets in any combolist that includes your domain. |
How Brandefense Detects Credential Stuffing Threats Before the Attack Runs
A supply chain comes before every credential stuffing attack. It is visible on the dark web if you know where to look. Brandefense’s Threat Intelligence platform monitors the sources, marketplaces, and distribution channels that supply attackers with credentials. This gives early warning at each stage of the attack pipeline.
| Brandefense Capability | What It Detects |
| Stealer Log Monitoring | Continuous scanning of infostealer log distributions for your organization’s domain credentials like employee accounts, partner credentials, and service account logins appearing in fresh stealer output |
| Combolist Marketplace Surveillance | Monitoring of dark web forums, Telegram channels, and credential marketplaces for combolists targeting your domain or platform detecting supply-side preparation before the campaign executes |
| Credential Exposure Alerting | Real-time alerts when your employees’ or customers’ credentials appear in newly found breach databases, combolists, or stealer logs. These alerts trigger forced resets before attackers test the credentials |
| Dark Web Forum Intelligence | Tracking of forum threads where tool configs for your platform are shared or discussed. This gives early warning when attackers are preparing to target your service |
| Breach Database Correlation | Continuous correlation of your organization’s email domains against newly discovered breach databases identifying historical exposure that may not yet have been rotated |
| 24/7 Analyst Coverage | AI does the work and analysts verify critical findings, with escalation for high-severity exposure events requiring immediate credential rotation or platform response |
Credential stuffing will not stop. The supply chain that produces combolists (infostealer malware, breach database aggregation, and dark web distribution) is industrialized, automated, and growing. Aggregated datasets of enormous size are already openly accessible. The organizations that avoid becoming case studies are not those with the strongest password policies. They are those with the earliest warning.
