Credential Stuffing
What is Credential Stuffing?
Credential stuffing replays username and password pairs stolen from one breach against other sites. It is not guessing: every pair was correct somewhere, and the attack works because people reuse passwords.
Success rates are low — typically a fraction of a percent — and the economics still work, because there are billions of pairs in circulation and automation makes each attempt almost free. A 0.1% success rate against a million attempts is a thousand working accounts.
Why it is hard to see
The individual request is indistinguishable from a real login. Correct form, valid headers, a plausible browser, one attempt per account. What identifies it is the pattern across the whole endpoint, and the attacker spends real money to hide exactly that pattern:
| Attacker technique | What it defeats |
|---|---|
| Residential proxy networks | Per-IP rate limits and address reputation |
| One attempt per account | Account lockout thresholds |
| Randomised timing and headers | Signature and velocity rules |
| CAPTCHA solving services | Visible challenges, at a few dollars per thousand |
| Credential lists sorted by freshness | Wasted attempts on dead pairs |
The first row is the significant one. Residential proxy access is sold by the gigabyte, and it means the attacker is arriving from ordinary household addresses in your own country. Blocking by address reputation then either misses the attack or blocks real customers.
The tells that survive
Even with all of the above, three signals are hard for the attacker to remove:
- Aggregate failure rate. Your overall ratio of failed to successful logins is a property of the endpoint, not of any one request. A distributed attack moves it, and no amount of proxy rotation hides it.
- Absence of a person. No pointer movement before submission, form completion faster than reading, a response arriving sooner than human reaction time. See behavioural analysis.
- Client contradictions. A claimed browser whose observable capabilities do not match it.
What to do about it
- Verify a human before checking the credential. This is the highest-value change: the attack dies before the password comparison, so the attacker never learns which pairs are valid — and a validated pair is itself a saleable asset.
- Make attempts cost something. Proof of work is negligible for one login and prohibitive across a million.
- Deploy phishing-resistant MFA. It makes a correct password insufficient, though it does not stop the attempts or the account enumeration.
- Check credentials against breach corpora at registration and password change, so reused pairs never become valid on your service.
- Rate limit on the endpoint's total failures, not only per address or per account — the per-account counter is what password spraying is designed to stay under.
- Alert on the aggregate ratio rather than on individual failures.
Do not rely on account lockout. It is a denial-of-service tool an attacker can aim at your own users.