Credential stuffing

How it works

OWASP defines credential stuffing as the automated injection of stolen username and password pairs into website login forms to gain access to accounts. The attacker obtains pairs from breaches or phishing, runs automated tools across many sites, and keeps the logins that work. Compromised accounts can then be used for fraud, data theft, spam or resale.

OWASP files credential stuffing under brute force attacks, with one difference: it replays pairs that already exist instead of guessing new ones. The OWASP automated threat entry separates credential stuffing, which tests credentials used in other applications, from credential cracking, which guesses new passwords. MITRE adds that it tends to target remote and management services such as SSH, RDP, LDAP and web logins, as well as cloud applications and single sign-on.

How it shows up in executive exposure

The fuel is leaked data: credential pairs from breach corpora, combolists and stealer logs. An executive whose email and password appear in an old breach is a candidate target, especially if that password is reused on a business account.

WebThreat's CEM checks each executive against breach corpora and leak databases and ranks the findings by what to fix first; an exposed password and appearance in several breaches move a leader up the list. The assessment works from records already in leaked data, so it needs no access to your systems. See the methodology. EDG3 watches the Telegram channels and dark web forums where combolists are traded.

How to reduce the risk

OWASP and MITRE point to the same set of defenses:

• Multi-factor authentication on every service, which OWASP calls a primary countermeasure.
• Checks of new passwords against known breached passwords.
• Account lockout and conditional access to block suspicious attempts.
• Proactive resets for accounts known to appear in breached credentials.
• Notifications to users about suspicious sign-ins.

For individuals, the main defense is a unique password per account. See password reuse.

How it differs from related terms

Password reuse is the habit that makes the attack work. Credential stuffing is the attack. Account takeover is what a successful attack produces. Brute force guesses passwords, while stuffing replays real ones. For more on the data it relies on, see what a combolist is.