Credential stuffing is the quiet workhorse of account takeover (ATO). While ransomware grabs headlines, attackers run automated login campaigns around the clock, testing username and password pairs harvested from breach data against consumer and enterprise login endpoints. The attack is cheap, easy to scale, and effective because of one stubborn habit: password reuse. The rest of this post is the attacker playbook, the reasons it still pays, and the defensive stack that actually stops it.
What credential stuffing actually is
Credential stuffing is a subset of brute-force attack cataloged by MITRE ATT&CK as T1110.004. Instead of guessing passwords, attackers replay known valid username and password combinations, leaked from prior breaches, against unrelated services. The logic is simple: if a user's Netflix password leaked in a 2022 forum dump, there is a meaningful chance the same password also works on their bank, corporate SSO, or cloud console.
Do not confuse credential stuffing with credential spraying. Credential spraying takes one common password (Summer2024!, Welcome1) and tries it against many usernames, typically to evade account lockouts. Credential stuffing takes many specific username and password pairs and tries each one exactly once on the assumption that the pair is already valid somewhere. Both are automated, both drive ATO, and both are mitigated with overlapping controls, but defenders need to recognize the difference when reading logs.
Why credential stuffing keeps working
The attack persists because the economics favor the attacker at every step:
- Supply is large and cheap. Combolists circulating on Telegram, cracked forums, and stealer log marketplaces routinely contain billions of records. Revealer.US checks 800+ platforms, public records, and known breach datasets, and that pool grows every week.
- Password reuse is widespread. Multiple large studies have found that 60 to 70 percent of users reuse passwords across at least one other account. For mid-tier consumer services, a well-curated combolist will have a hit rate of one to three percent, more than enough to make the campaign profitable.
- Bot infrastructure is cheap. Residential proxy networks rent rotating IPs for a few dollars per gigabyte. Headless browser frameworks solve basic JavaScript challenges. CAPTCHA-solving services clear reCAPTCHA for fractions of a cent.
- Monetization is instant. A verified account can be resold in hours on underground markets, drained of loyalty points, used to launder stolen cards, or pivoted into higher-value corporate systems.
The role of infostealers
A significant portion of modern credential stuffing fuel comes not from old SQL dumps but from fresh infostealer logs. Families like RedLine, Lumma, Vidar, and StealC siphon browser-stored passwords, session cookies, and autofill data from infected endpoints and publish them within hours. That means the credentials being stuffed against your login endpoint today may have been valid on the victim's machine this morning, which undercuts the assumption that breach data is stale. Checking stealer logs for those fresh pairs is a different problem from checking a years-old dump.
The attacker playbook step by step
The operational flow tells you where to intervene. A typical campaign runs six stages:
- Acquisition. The attacker buys or scrapes combolists from breach aggregators, Telegram channels, or stealer log shops. Lists are often tagged by country, service, or freshness.
- Curation. Raw combolists are deduplicated, filtered by target domain, and sometimes enriched with metadata like last-seen dates or associated cookies.
- Target selection. Attackers identify login endpoints with weak controls, legacy APIs, mobile app backends without bot protection, password reset flows, or OAuth token endpoints that skip CAPTCHAs.
- Infrastructure setup. Tools like OpenBullet, SilverBullet, and SentryMBA are configured with custom configs ("configs") that handle the target's authentication flow, including any JavaScript tokens or header quirks.
- Execution. The stuffer runs at controlled velocity, distributing requests across thousands of residential IPs to stay under rate limits and blend with legitimate traffic. Successful hits are written to a "hits" file.
- Exploitation. Verified accounts are cashed out, resold, or used as footholds. In enterprise contexts, a single hit on an employee SSO can cascade into full domain compromise.
MFA bypass techniques
Defenders sometimes assume multi-factor authentication renders credential stuffing obsolete. It does not. Modern ATO crews routinely bypass MFA using:
- Session cookie theft from infostealer logs, which skips the login entirely
- MFA fatigue (push bombing) until an exhausted user approves
- SIM swap to intercept SMS OTPs on high-value targets
- Adversary-in-the-middle phishing kits like Evilginx and Tycoon that proxy legitimate MFA prompts
- Help desk social engineering to reset MFA enrollment
MFA is necessary. It is not sufficient.
Detection signals that actually catch it
Credential stuffing leaves a fingerprint in authentication logs, if you look in the right places:
- Failed login velocity anomalies. A sustained spike in failed logins, especially across many distinct usernames, is the clearest indicator. Baseline normal failure rates per endpoint and alert on multi-sigma deviations.
- Geographic impossibility. Successful logins for the same account from two cities in quick succession, or a sudden shift in the geographic distribution of login traffic, both point to automation.
- User agent and TLS fingerprint entropy. Stuffing tools tend to either reuse a narrow set of user agents or cycle through implausible combinations. JA3 and JA4 TLS fingerprints often reveal headless browser frameworks.
- Timing patterns. Human logins cluster by time of day and regional activity. Bot traffic is flat and runs 24/7, often at machine-precise intervals.
- Success ratio shifts. A normal login endpoint has a failure rate of five to fifteen percent. A stuffing wave can push that to 90 percent or higher within minutes.
- Credential freshness correlation. When failed usernames correlate with accounts that recently appeared in breach data, you are almost certainly watching a stuffing campaign in progress. That correlation is why a data breach lookup belongs in the detection loop, not just in a quarterly audit.
The defense stack that actually stops ATO
One control will not stop credential stuffing. Stack layers until the campaign costs more than it returns.
1. Eliminate password reuse at the source
The root cause is users reusing breached passwords. Enforce a compromised-password check at registration and password change using a maintained breach corpus. Revealer.US lets you check those corpora with a data breach lookup and an email lookup across 800+ platforms, public records, and known breach datasets, so security teams can block known-compromised passwords before they become a stuffing target.
2. Strong, phishing-resistant MFA
Deploy FIDO2 or WebAuthn wherever possible. Passkeys, hardware tokens, and platform authenticators are immune to replay, push bombing, and adversary-in-the-middle kits. Treat SMS OTP as a fallback, not a control.
3. Bot management and rate limiting
Deploy a bot management solution that combines device fingerprinting, behavioral biometrics, and TLS fingerprinting. Enforce aggressive per-IP, per-ASN, and per-account rate limiting on all authentication endpoints, including mobile APIs, password reset, and OAuth token endpoints that are often forgotten.
4. Risk-based authentication
Score every login attempt on device reputation, geolocation, time of day, and network origin. Step up to MFA or deny outright on high-risk scores. Keep friction low for legitimate users. Make attackers pay for every attempt.
5. Credential exposure checks
When an employee or customer credential surfaces in a dump or a stealer log, force a password reset before the credential gets used. That closes the window between exposure and exploitation from weeks to hours. Wire the check into your existing tooling through the API if you do not want analysts running it by hand.
6. Account takeover response playbook
When ATO succeeds despite defenses, speed matters. Pre-build a runbook that covers session invalidation, password reset enforcement, customer notification, fraud reversal, and forensics. Rehearse it. The difference between a minor incident and a headline breach is usually measured in hours.
Conclusion
Credential stuffing will last as long as breach data is cheap and users reuse passwords. Automated ATO remains the cheapest path into accounts. It is also one of the more defendable threats in the current stack, if you layer controls, check for credential exposure, and treat MFA as a floor rather than a ceiling.
Most of the organizations that lose to stuffing treated it as a bot problem. It is an identity problem. Fix the identity layer, starve the attack of reusable credentials, and the stuffers will move on to easier targets.
Want to see whether workforce or customer passwords are already in circulation? Run a data breach lookup or check stealer logs in Revealer.US.
Frequently asked questions
What is the difference between credential stuffing and password spraying?
Stuffing replays known username-and-password pairs from breaches and stealer logs, usually once per pair. Spraying tries a small set of common passwords against many usernames to stay under lockout thresholds. Both show up as automated login noise. The list you are matching against is what tells them apart.
Does MFA stop credential stuffing?
It stops a large share of password-only hits. It does not stop session-cookie theft from infostealers, MFA-fatigue push bombing, SIM swap against SMS OTP, adversary-in-the-middle kits, or help-desk resets. Prefer FIDO2 or passkeys, and treat SMS as a fallback.
What hit rate do stuffing campaigns typically see?
For mid-tier consumer services, a well-curated combolist often hits in the one to three percent range. That is enough to make a cheap campaign profitable. Hit rate tracks password reuse and list freshness, not attacker skill.
How do infostealers change the stuffing threat?
They shrink the time between theft and use from months to hours, and they often include session cookies that skip the login. A dump from 2022 is a reuse problem. A Lumma or RedLine log from this morning is a live-session problem.
What logs should I watch for stuffing?
Failed-login velocity across many distinct usernames, a sudden jump in failure ratio (five to fifteen percent is typical; stuffing can push it past 90 percent), flat 24/7 timing, odd user-agent or TLS fingerprints, and overlap between failing usernames and accounts that just appeared in a breach corpus.
How do I check if users' passwords are already in breach data?
Run the email or username against known breach datasets and stealer logs, then force a reset on hits before the pair is stuffed. Revealer.US does that lookup across 800+ platforms, public records, and known breach datasets. Do not use the result as an employment, tenant, or credit decision; it is OSINT, not a consumer report.