Credential stuffing
noun · MITRE ATT&CK T1110.004
Automated sign-in attempts using username and password pairs leaked from other breaches, betting that people reuse the same password.
When a website is breached, its list of email addresses and passwords often ends up for sale or shared publicly. Credential stuffing takes those pairs and tries them against other services, at scale, with tools that rotate through thousands of IP addresses. It works because many people use the same password in several places.
Credential stuffing is easy to confuse with its neighbors:
- Brute force tries many passwords against one account.
- Password spray tries a few common passwords against many accounts.
- Credential stuffing tries one known password per account, taken from a previous leak.
Example
A sign-in log shows thousands of attempts against different accounts over an hour, coming from hundreds of residential IP addresses. Most fail because the username does not exist or the password is wrong, but a few dozen succeed on the first try, all for users whose personal email appeared in an old breach of a gaming site.
Why it matters for a SOC analyst
A high failure rate spread across many accounts and many IP addresses, with occasional immediate successes, is the signature to look for. Treat every success as a compromised account. Long term, MFA and password checks against known-breached lists blunt the attack; phishing-resistant MFA stops it entirely.
Related terms
- Brute force
Gaining access by systematically trying passwords or keys until one works, either online against a login or offline against stolen hashes.
- Password spray
An attack that tries a few common passwords against many accounts, staying under lockout limits that per-account guessing would trigger.
- Phishing-resistant MFA
Authentication methods, such as passkeys, FIDO2 keys and Windows Hello for Business, that cannot be relayed or approved by a phished user.
- Conditional Access
Microsoft Entra ID's policy engine that decides, at each sign-in, whether to allow access, require MFA or another control, or block.