# What is Credential Stuffing?

> Credential stuffing is the automated or repeated use of previously exposed username-and-password pairs to attempt access to other accounts or services.

- Canonical URL: https://yellowcube.eu/glossary/credential-stuffing/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

It exploits credential reuse: the attacker is not primarily guessing a new password but testing whether a pair already obtained from a breach, phishing campaign, malware collection, or another source is still valid elsewhere.

Campaigns may test large collections through distributed infrastructure and imitate normal clients. A successful attempt can resemble the legitimate holder’s own sign-in because the service receives a valid password. Outcomes include account takeover, fraud, data access, or a foothold for attacks on connected services.

### Key points

- **Signals:** Look for reused identifiers across attempts, unusual account and source patterns, mixed failures and valid logins, automation characteristics, and sensitive actions after authentication.
- **Prevention:** Reduce password reuse through clear guidance and password-manager support, screen new passwords against compromised-value blocklists, use phishing-resistant multi-factor authentication (MFA), and apply layered risk and rate controls.
- **Response:** Revoke affected sessions, reset exposed passwords, replace or review other authenticators, remove unauthorized changes, examine connected accounts, notify affected users appropriately, and investigate the original exposure where known.
- **Important limitation:** An exposed pair does not prove that it remains valid or was tested, and a successful login does not by itself prove credential stuffing. Attackers may also use stolen sessions, recovery paths, or newly phished credentials that produce similar account activity.

### Related terms

[Brute-force attack](<https://yellowcube.eu/glossary/brute-force-attack/>) · [Login credentials](<https://yellowcube.eu/glossary/login-credentials/>) · [Account takeover (ATO)](<https://yellowcube.eu/glossary/account-takeover/>) · [Multi-factor authentication (MFA)](<https://yellowcube.eu/glossary/multi-factor-authentication/>) · [Identity-based attack](<https://yellowcube.eu/glossary/identity-based-attack/>) · [Password spraying](<https://yellowcube.eu/glossary/password-spraying/>) · [Password manager](<https://yellowcube.eu/glossary/password-manager/>)

### Sources

[MITRE ATT&CK T1110.004: Credential Stuffing](https://attack.mitre.org/techniques/T1110/004/) · [OWASP Credential Stuffing Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Credential_Stuffing_Prevention_Cheat_Sheet.html) · [NIST SP 800-63B-4: Authentication and Authenticator Management](https://pages.nist.gov/800-63-4/sp800-63b.html)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.