Also known as: account takeover · ATO
Credential stuffing is an automated attack that takes username and password pairs leaked from one breach and tries them en masse against other services, exploiting the fact that many people reuse the same password across sites.
It is distinct from brute forcing: the attacker is not guessing passwords but replaying known-valid ones. Success rates per attempt are low — often well under one percent — but at a scale of millions of attempts that still yields substantial numbers of compromised accounts.
Rate limiting alone is a weak defence because attacks are distributed across large proxy networks. Effective mitigation combines breached-password screening at registration and login, device and behavioural signals, and above all multi-factor authentication.
Multi-Factor Authentication
Multi-factor authentication (MFA) requires two or more independent categories of evidence to verify identity — typically something you know, something you have, and something you are — so that a stolen password alone is insufficient to gain access.
Passkey
A passkey is a phishing-resistant credential based on public-key cryptography that replaces passwords: the private key never leaves the user's device, and authentication is cryptographically bound to the legitimate site's domain.
Phishing
Phishing is a social-engineering attack in which an adversary impersonates a trusted party — typically via email, SMS, or a cloned website — to trick a victim into revealing credentials, authorising a payment, or installing malware.
Initial Access Broker
An initial access broker (IAB) is a criminal specialist who breaches organisations and then sells that access to other attackers, such as ransomware affiliates, rather than monetising the intrusion themselves.
Password Hashing
Password hashing is the practice of storing passwords as the output of a deliberately slow, salted one-way function, so that a breach of the credential database does not immediately yield usable plaintext passwords.