credential stuffing
termsecurity
Automated login attempts using username and password pairs stolen from other breaches.
Because people reuse passwords, a set leaked from one site is tried en masse against many others. It is not guessing; it is replaying known-good pairs, which is why unique passwords and multi-factor authentication defeat it.
Credential stuffing is not password guessing. The attacker already has real username and password pairs, harvested from somebody else's breach, and is simply trying them against your service on the reasonable assumption that people reuse. Success rates are low per attempt and enormous in aggregate, which is why it is run at scale rather than targeted.
This defeats most defences aimed at brute force. The passwords are correct, so complexity rules do not help. Attempts come from distributed residential proxies, so per-IP rate limiting sees a trickle. Each individual login looks entirely legitimate because, from the authentication system's perspective, it is: valid credentials, correctly presented.
What actually works is making the password insufficient. Multi-factor authentication breaks the economics outright, since a valid pair no longer completes a login. Beyond that, detection shifts to behaviour rather than correctness, looking at velocity across accounts, device and client fingerprints, and impossible travel. Checking credentials against known-breached corpora at registration and at reset closes the loop, because the fastest way to survive a reused password is to refuse it.
Also known as: credential-stuffing, cred stuffing