What is Credential Stuffing?

Credential stuffing is an automated attack technique where attackers take lists of usernames and passwords exposed in data breaches from one service and systematically attempt to log into accounts on other services. The attack relies on the widespread habit of password reuse: people often use the same email and password combination across multiple websites and applications.

The attacker typically obtains credential pairs from public breach dumps, dark web marketplaces, or paste sites. These lists are fed into automated tools, often custom scripts or frameworks like OpenBullet or Sentry MBA, which rapidly submit login requests to target services. The tools can rotate IP addresses via proxies, mimic realistic browser headers, and handle CAPTCHAs or rate limiting to evade detection. A success rate of 0.1 to 2 percent is common, meaning a list of 10 million credentials can yield thousands of compromised accounts on a single target site.

In the wider security landscape, credential stuffing is a subset of account takeover (ATO) attacks. It differs from brute-force attacks, which guess passwords against a known username, and from password spraying, which tries a few common passwords against many accounts. Mitigations include multi-factor authentication (MFA), device fingerprinting, login velocity limits, and requiring users to verify identity from new locations. The OWASP Automated Threats to Web Applications guide (OWASP-008) classifies credential stuffing as an automated threat pattern.