What is Credential Stuffing?

The attack is built on volume and automation rather than guessing. Adversaries pull breach dumps, often traded or sold on criminal forums, containing millions of email-and-password combinations, and feed them through purpose-built tools such as Sentry MBA, OpenBullet, or custom headless-browser scripts that can submit login attempts far faster than a human ever could. To evade basic rate limiting, these tools distribute requests across large pools of residential or datacenter proxy IPs and pace each individual IP's request rate to stay under detection thresholds, so no single source looks abnormal in isolation even though the aggregate campaign is testing thousands of accounts.

Credential stuffing differs from brute force in a way that matters for detection: brute force guesses many passwords against one account, while credential stuffing tests one already-known, previously valid password against one specific account, then moves to the next account with its own previously known password. The per-attempt success rate is comparatively high, commonly cited in industry reporting in the low single-digit percent range, because the passwords being tried are not guesses, they are real passwords that worked somewhere else, and enough people reuse them for the volume to pay off even at that rate.

Defenses layer at several points. Multi-factor authentication is the single most effective control, since a correct password alone no longer grants access. Behavioral bot detection built into modern WAFs and CDN platforms fingerprints automation (headless browser signatures, unnatural request timing, missing JavaScript execution) rather than relying on IP reputation alone. Breach-credential screening services let an organization check new or existing passwords against known-compromised lists at signup or login time and force a reset when a match is found. Rate limiting scoped per account, not just per source IP, closes the low-and-slow evasion gap that per-IP limits alone leave open.