What is credential stuffing?¶
Credential stuffing is the automated use of previously stolen username-and-password combinations against other services.
Avoid the dangerous assumption¶
The dangerous assumption is that the target service must have been breached because valid credentials were used there.
It may not have been.
Users often reuse credentials across several services. An offender may obtain a credential pair from one breach and test it elsewhere.
Evidence may include:
- large numbers of login attempts
- known breached credential combinations
- repeated attempts across many accounts
- automation patterns
- unusual user agents
- successful access after earlier failures
- source infrastructure associated with bulk authentication.
Investigators should identify whether the credentials were valid on the target service and whether they were reused from elsewhere.
Do not assume that every successful login resulted from credential stuffing. The same account may have been compromised through phishing, malware, password spraying or another method.
Likewise, the existence of leaked credentials does not prove they were used in the incident.
Ask the affected organisation for authentication records, account identifiers, source details, device or session information, application identifiers and the exact time period.
Where lawful and proportionate, compare the suspected credentials with known breach exposure without unnecessarily reproducing or distributing the credentials themselves.
Credential stuffing is usually automated, but automation does not remove personal responsibility. It changes the scale and timing of the activity.
The source IP addresses may represent proxies, compromised devices, hosting infrastructure or distributed services.
Operational takeaway¶
Treat credential stuffing as reuse of credentials stolen elsewhere, and distinguish the source breach, automated testing and any later successful account access.