What is credential stuffing?

Credential stuffing is an automated attack in which criminals replay username and password pairs leaked from one service against the login endpoints of other services. It works because people reuse passwords: if a user's credentials from a breached forum also unlock their streaming or banking account, the attacker walks in through the front door. It is one of the most common paths to account takeover.

How it works

Attackers start with a combolist, a file of email and password pairs compiled from past breaches. These lists circulate cheaply, and OWASP ranks the resulting attacks among the most common techniques for taking over user accounts. The attacker loads the list into an automation tool, points it at a login endpoint, and lets bots submit each pair once.

Two things make the economics work. Proxy networks, often residential, spread the traffic across thousands of IPs so no single address looks busy. And the attack only needs a small fraction of pairs to succeed: even a fraction of a percent of a ten million line list yields thousands of working accounts, which the attacker drains or resells.

Credential stuffing is not brute force, and the difference matters for defense. Brute force hammers one account with many password guesses, which lockout policies catch quickly. Stuffing sends one or two attempts per account across a huge set of accounts, so per-account lockouts never trip. You have to read the traffic in aggregate, not account by account.

How to detect it

The clearest signal is velocity measured against something the attacker cannot rotate cheaply. IP velocity helps (hundreds of login attempts from one address is an easy call), but proxies blunt it. Device velocity is harder to evade: when device fingerprinting shows one device identity attempting logins for dozens of unrelated usernames, you are watching a stuffing run even if every attempt arrives from a different IP.

Automation signals come next. Stuffing tools run headless browsers or raw HTTP replays, and both leak. Webdriver flags, missing browser APIs, a user agent that contradicts the TLS or HTTP fingerprint, and forms submitted with no keystrokes or pointer events all point the same way. Bot detection on the login endpoint catches most off-the-shelf tooling.

Failure patterns give it away at the aggregate level. A login endpoint has a fairly stable baseline failure rate. During a stuffing run the rate spikes, and the failures look odd: spread thinly across many accounts with one or two attempts each, heavy on "unknown user" errors because the list is stale. The attempts often land at machine-regular intervals too.

Finally, watch the successes. A stuffed login that works still carries the attacker's context, not the owner's. A success from a new device, a datacenter ASN, or a location that implies impossible travel from the account's last session deserves a step-up challenge before it turns into a takeover.

How Rupt handles it

Rupt scores every login attempt with device identification, automation detection, and velocity rules, so a stuffing run stands out even when it is spread across residential proxies. The account takeover prevention guide covers the login setup, and the account takeover solution covers what to do with the attempts that get through.