It exploits credential reuse: the attacker is not primarily guessing a new password but testing whether a pair already obtained from a breach, phishing campaign, malware collection, or another source is still valid elsewhere.
Campaigns may test large collections through distributed infrastructure and imitate normal clients. A successful attempt can resemble the legitimate holder’s own sign-in because the service receives a valid password. Outcomes include account takeover, fraud, data access, or a foothold for attacks on connected services.
Key points
SignalsLook for reused identifiers across attempts, unusual account and source patterns, mixed failures and valid logins, automation characteristics, and sensitive actions after authentication.
PreventionReduce password reuse through clear guidance and password-manager support, screen new passwords against compromised-value blocklists, use phishing-resistant multi-factor authentication (MFA), and apply layered risk and rate controls.
ResponseRevoke affected sessions, reset exposed passwords, replace or review other authenticators, remove unauthorized changes, examine connected accounts, notify affected users appropriately, and investigate the original exposure where known.
Important limitationAn exposed pair does not prove that it remains valid or was tested, and a successful login does not by itself prove credential stuffing. Attackers may also use stolen sessions, recovery paths, or newly phished credentials that produce similar account activity.