TL;DR: what is credential stuffing
- Automated testing of leaked username and password pairs against a login endpoint, often thousands per second.
- It works because roughly 65% of people reuse passwords and breach compilations like RockYou2024 expose billions of pairs.
- The detection stack: HIBP lookup, IP reputation, headless-browser flags, velocity limits, behavioral session-trust scoring.
How credential stuffing differs from related attacks
Credential stuffing uses real, previously breached credentials instead of guessing, which is why controls designed to stop guessing-based attacks let it through.
Credential stuffing vs brute force. A brute force attack generates password guesses algorithmically: random strings, dictionary words, character combinations. It needs no prior knowledge of the victim's actual password. Credential stuffing works the other way around. It replays real email and password pairs pulled from previous breaches, so the attacker is testing credentials that already worked on some other service rather than guessing.
Credential stuffing vs password spraying. Password spraying tries one or a few common passwords (such as "Password1" or "Welcome2024") against a large list of accounts, staying under lockout thresholds by using very few passwords per account. Credential stuffing tests one specific password, the one tied to that email in the breach data, against the target service. It runs one known pair per account rather than one common password across many accounts.
How a credential stuffing attack works
Credential stuffing follows a consistent five-step pattern.
-
The attacker buys a credential list from a breach marketplace. Lists with millions of email and password pairs are cheap, and many circulate for free on forums. The pairs come from earlier breaches at unrelated services.
-
An automated framework tests each pair against the target login endpoint. It is tuned to stay within rate limits, mimic natural request timing, and rotate through many IP addresses.
-
Requests are spread across residential proxy networks, so each IP makes only a few login attempts. That keeps every address under per-IP rate limits and off blocklists. A single run can span hundreds of thousands of IP addresses.
-
Successful logins are recorded automatically. On a large, fresh list the success rate usually lands between 1% and 3%. Against 10 million pairs, that is up to 300,000 working accounts from one run.
-
The attacker monetises the hits: draining stored payment methods, loyalty points, or personal data; reselling the validated pairs in bulk; or feeding the accounts into a wider fraud operation.
Why credential stuffing still works in 2026
Two factors compound in the attacker's favor. Breach databases holding hundreds of millions of real credentials are cheap and easy to find, and most people still reuse passwords across services.
Breach data is abundant. The Verizon Data Breach Investigations Report 2026 found stolen credentials in 39% of all data breaches, so a large share of active users already have at least one exposed pair in circulation. The raw material for an attack is trivial to obtain.
Password reuse remains common despite years of advice against it. Someone who signed up for a breached service in 2019 and reused that password on five other sites has handed an attacker the keys to all five. The attacker does not need to know which services the victim uses. They test the pair against the most popular web services and log the hits.
Put together, a large breach database plus even a modest success rate produces a meaningful number of compromised accounts per run, which is what keeps credential stuffing near the top of the fraud economy.
Three documented examples
Three well-known incidents show the same structure. In each case the attacker used credentials from an unrelated breach to compromise accounts on the target platform, not a flaw in the target itself.
Zoom, 2020. After the pandemic surge in video conferencing, a credential stuffing campaign against Zoom accounts produced a large batch of valid logins offered for sale. The credentials did not come from a Zoom breach. They came from replaying previously leaked pairs against Zoom's login endpoints, which showed how fast user-base growth expands exposure regardless of a company's own security.
PayPal, 2022. PayPal disclosed a credential stuffing incident affecting roughly 35,000 accounts. Attackers reached names, addresses, dates of birth, tax identification numbers, and partial card details. The credential pairs were sourced externally, not from a compromise of PayPal's systems.
23andMe, 2023. Attackers used credential stuffing to get into 23andMe accounts where users had reused passwords from other breached services. Inside accounts with the DNA Relatives feature enabled, they pivoted through the social graph to reach profile data on a far larger set of users. A modest number of directly compromised accounts led to a much larger downstream exposure.
Why standard defenses fall short
The most common defenses (rate limiting, CAPTCHA, and MFA) each have structural limits that modern campaigns are built to exploit.
Per-IP rate limiting. Residential proxy rotation spreads the attack across a huge pool of addresses. A rule that blocks after five failed attempts per IP does nothing when each IP makes one to three attempts before rotating.
CAPTCHA. CAPTCHA-solving services run at scale for very little money. Automated solving is a commodity, so CAPTCHA adds friction without stopping a determined attacker who holds a large list.
Forced password resets. Resets are reactive. They cut access after the attacker is already inside, often hours or days after the run finished and the accounts were exported.
MFA. Multi-factor authentication is the strongest standard defense and shrinks the attack surface, but it only protects accounts where it is switched on, and adoption is often low. Even where MFA is enabled, attackers who obtain session access another way (for example session hijacking after a valid login) remain a threat.
What actually catches it: device fingerprint correlation
The defining trait of a credential stuffing run is that one device, or a small set of devices, tries to log into many different accounts in sequence. IP rotation hides that at the network layer, so a WAF or rate limiter looking at individual requests never sees it.
Browser-layer device fingerprinting makes the pattern visible. When the same stable device fingerprint shows up across login attempts on ten different accounts inside a short window, that is a credential stuffing signal no matter how many IP addresses were involved. The fingerprint follows the device, not the network path.
cside builds a stable device fingerprint that persists across incognito, VPN connections, and cookie clearing, using more than 100 browser signals per session, and exposes cross-account device correlation in real time through an API and script tag. The verdict comes back before the login is processed, so your authentication layer can challenge or block the attempt as it happens instead of finding it after accounts are already drained.
For a full walkthrough of detection methods and defensive architecture, see the companion guide, Credential Stuffing: How to Detect and Stop It.
Further reading
