What Is Credential Stuffing?

Credential stuffing occurs when a cybercriminal obtains a large number of stolen or leaked login credentials—username and password pairs—for one website and tests them on the login pages of other websites. The attacker’s goal is to gain unauthorized access to as many user accounts as possible and then carry out other attacks or fraudulent activities. Those could involve account takeoversA type of identity theft in which a fraudster uses the stolen or faked credentials of a legitimate user to take over one or multiple accounts, especially banking, credit card, or ecommerce. (ATOs) that enable attackers to drain money from bank accounts, make large purchases, or steal identities to create new, fraudulent accounts. At worst, an attacker tries to escalate user privileges to gain a foothold in an organization’s network and carry out more serious attacks. Using readily available attack tools, cybercriminals can feed (or “stuff”) hundreds of thousands or even millions of compromised credentials into the login pages of one or more websites at a time.

Why Credential Stuffing Attacks Are Possible

Although credential stuffing attacks have been around for years, they’re quickly becoming one of the most prevalent attack types. But why are they even possible? What makes them feasible?

Here are some of the primary reasons:

• “Username and password” is the universally accepted identity mechanism for access control. Nearly all online accounts (and many mobile apps) grant users access based on their ability to “prove” their identity by supplying the correct username and password. Unfortunately, this type of authenticationAuthentication is the processes of verifying a user’s identity claim in order to grant them access to a requested resource. is only marginally secure since it relies on just one factor: something the user knows (which someone else can easily know). More secure authentication systems require users to provide additional and distinct authentication factors, such as something the user has (a separate token or code) or something the user is (a biometric factor such as a fingerprint). The most sophisticated access systems perform additional environmental and behavioral checks, looking at things like device type and characteristics, browser information, location, time of day, and more.
• Many people reuse passwords for multiple accounts. It’s estimated the average person has anywhere from 70 to nearly 200 accounts that require passwords. Since it’s difficult for anyone to remember so many unique passwords, it’s not surprising that 65 percent of people admit to reusing passwords for many or all accounts. The problem is, once attackers obtain legitimate credentials from one website, it’s virtually guaranteed that some will work when attackers test them on other websites.
• Monstrous data breaches continue to occur. 2005 saw the first data breach of over 1 million records, which was startling at the time, until another breach of 94 million records occurred that same year. Eight years later, the Yahoo data breach exposed an astonishing 3 billion records. And yet data breaches have continued to climb ever since. One research firm reported that 7,098 data breaches occurred in 2019, exposing over 15.1 billion records. And while credentials are not exposed in every data breach, the same firm reported that credentials have been the number one compromised data type since 2012. Nothing points more to this fact than the 2.2 billion unique passwords exposed in 2019 in what’s known as “Collections #2 – #5.”^, , 
• Credential stuffing has a low cost of entry and high returns. Massive data breaches are great news for cybercriminals, because credential stuffing is a numbers game—and a profitable one. A small-time cybercriminal can test 100,000 credentials for an investment of less than $200. And even though the typical success rate is only between .2 percent and 2 percent, the attacker can net anywhere from 200 to 2,000 valid accounts from a single attack. For a cybercriminal willing to make a larger investment, a million fraudulent login attempts could yield as many as 20,000 valid accounts. Attackers can then run the same attacks on other websites with similar success rates. And after milking the credentials themselves, they can make money selling those “used” credentials on the dark web (see Step 5 under “How Credential Stuffing Attacks Work”).
• There is a significant window of opportunity for abuse. The public is often not made aware of data breaches for months or even years after they occur. The average time between a data breach and its discovery or public disclosure is 15 months. This gives attackers plenty of time to abuse stolen credentials.

You might guess that some of those credentials would no longer be valid, but since users often recycle passwords, many of them become valid again. In addition, many people have accounts they rarely use or have forgotten about, so the passwords for those, which haven’t changed in years, could also be valid on more current accounts.

How Credential Stuffing Attacks Work

This confluence of factors creates the perfect storm for attackers. A typical scenario works like this and is shown in Figure 1:

1. Obtain legitimate credentials. In the past, skilled attackers had to break into sites to steal credentials. But today, so many valid credentials are already stolen and readily available on the dark web that even unskilled attackers can easily obtain them, often for free.
2. Acquire IP proxy services to aid in the attack. To be successful, credential stuffing attacks must appear like regular network traffic on the targeted website. Millions of login requests suddenly coming from a single IP address in a short time period would raise red flags with defenders. To avoid this, attackers enlist the help of IP proxy service providers that use bots to distribute login requests across thousands of IP addresses, thus helping to hide suspicious attacker activity.
3. Prepare for and set up the attack. If credential stuffing attacks had to be done manually, they would never be feasible or profitable, so automation is the key to their success. Rather than writing automation scripts themselves, many attackers use so-called “account checker” tools such as Sentry MBA, SNIPR, and OpenBullet. These automation (bot) tools make it easy for attackers to feed in a huge list of stolen username and password pairs and then test them on targeted sites. Additional features vary by tool. Some may easily accept a list of IP proxies from known providers. Others include configuration files to help attackers set up an attack based on what’s known about the targeted login page. Still others include features to help attackers evade a site’s web application defenses (such as CAPTCHAsA security mechanism some websites use to distinguish humans from bots. Typically, a user must copy skewed characters correctly or click on multiple items in an image.).
4. Launch the attack. Once the attack is set up, it’s ready to launch. The attacker’s objective is to uncover all successful login requests. As the tool runs through the supplied credentials, the attacker is notified of valid ones. Technically, the attack itself is complete when the attacker receives these results. But simply obtaining a list of valid credentials is not the attacker’s end game.
5. Monetize. Armed with a list of validated credentials for a target site, attackers pivot to monetization. How they accomplish this depends on their objective and the type of site attacked. Account takeovers (ATOs), a form of identity fraud, are common. The goal is to drain accounts of their value, so attackers might steal funds through fraudulent banking transactions, make large purchases on e-commerce sites, take cash advances against credit cards, or liquidate gift or rewards cards for cash or products. More sophisticated attackers use legitimate accounts to gain deeper access into a victim’s network, escalating privileges to carry out more sinister acts like shutting down infrastructure or stealing company information or trade secrets.

Surprisingly, after attackers spend 18 to 24 months monetizing the credentials themselves, they can still make “aftermarket” money selling validated credentials to other cybercriminals, who use them on other websites for similar fraudulent activities. “Old” credentials might sell for less than $1 each, while newer ones might sell for $12–$15 each, depending on the accounts. The most valuable credentials, such as for banking and credit card sites, can sell for $70 to $500 each.