Detect credential stuffing earlier and more accurately versus
server-based detection and expose threat actors
Credential stuffing can account for a substantial share of authentication traffic, blending automated credential testing into legitimate login activity. It’s a bot, replaying stolen credentials from someone else’s breach, hoping your customer reused a password.
That’s not a hypothetical. Verizon’s 2025 DBIR research found that credential stuffing accounts for 19% of all authentication attempts at the median enterprise on any given day. At large organizations, that figure climbs to 25%. Because attackers submit valid credential pairs and distribute attempts across accounts and infrastructure, conventional controls may struggle to link the activity to a single campaign.
This guide gives you everything you need: a precise understanding of how credential stuffing works, who’s behind the most damaging attacks of 2024 and 2025, why the defenses you already have aren’t enough, and a layered framework for stopping account takeover before it reaches the bank account.This guide gives you everything you need: a precise understanding of how credential stuffing works, who’s behind the most damaging attacks of 2024 and 2025, why the defenses you already have aren’t enough, and a layered framework for stopping account takeover before it reaches the bank account.
Credential stuffing is a cyberattack in which an attacker uses a list of username-password pairs stolen from a data breach to automatically test them against another service. The attack exploits one core human flaw: password reuse.
The logic is brutally simple. Your customer used the same email and password for their Netflix account as they do for their online banking portal. Netflix gets breached. Your bank gets stuffed
Unlike brute force attacks, which guess passwords randomly, credential stuffing uses real credentials that already worked somewhere. The attacker doesn’t need to crack anything. They just need to test at scale.
Verizon’s 2025 DBIR found that only 49% of a typical user’s passwords across services are distinct from one another. That means roughly half of every credential set stolen in a breach will open doors somewhere else. At millions of accounts, that probability is essentially a guarantee. This indicates substantial password reuse among the compromised users studied, increasing the likelihood that some stolen credentials will also work across other services.
What makes credential stuffing particularly dangerous for organizations isn’t just the attack itself. A successful credential-stuffing attempt may appear valid when the authentication event is viewed in isolation. The surrounding device, behavioral, account, velocity, and historical signals may still reveal elevated risk.
The attack lifecycle breaks into four phases. Understanding each one is the first step toward disrupting it.
Attackers source credentials through three primary channels:
- Data breach dumps: Stolen from previous breaches and sold or shared on dark web forums and Telegram channels. In 2024, SpyCloud recaptured 548 million malware-exfiltrated credentials from the criminal underground in that year alone.
- Infostealer malware: Malware families like Lumma, RedLine, and StealC infect user devices and silently scrape saved passwords, session cookies, and autofill data from browsers. SpyCloud recorded 18+ million unique malware infection logs in 2024, with an average of 44 exposed credentials harvested per infection.
- Phishing: Credential-harvesting pages and AiTM (adversary-in-the-middle) proxy kits capture credentials in real time.
These raw credentials are cleaned, formatted as `email:password` pairs, and sold as combolists. Fresh lists built from recent infostealer logs command premium prices because their validity rates are higher.
Attackers feed combolists into automation frameworks. OpenBullet and its successor SilverBullet are the most widely used. Both were originally released as penetration testing utilities. Both are now standard in account takeover (ATO) operations.
These tools automate the full attack loop: loading credentials, rotating through proxy pools, sending login requests formatted to mimic legitimate browser headers, and logging successful hits.
Attackers also buy custom configuration files, called “configs,” which define the exact authentication flow for a specific target. Configs for banking portals, SaaS platforms, and enterprise SSO providers are bought and sold alongside combolists in the same underground markets.
This is where credential stuffing separates from older attack types. Modern campaigns don’t send thousands of requests per second from a single IP.
They use:
- Residential proxy networks: Requests may originate from residential proxy networks, reducing the effectiveness of IP blocking when it is used without additional device, behavioral, and account-level context. Each credential test can come from a different city.
- Low-and-slow timing: Attacks spread attempts over hours or days, staying below rate-limiting thresholds. At one login attempt per account, there are no lockouts to trigger.
- Header spoofing: Tools craft requests with legitimate-looking browser headers, user agents, and device fingerprints to pass basic bot detection checks.
- CAPTCHA-solving services: Human-powered or ML-based solving farms bypass CAPTCHA challenges in near real time.
Once a valid credential is confirmed, attackers move fast. Account details are checked for value (stored payment cards, loyalty points, healthcare records, retirement balances). High-value accounts are drained, sold, or used for further fraud. In enterprise environments, a single compromised SSO account becomes a foothold for lateral movement.
The MemcycoFM Show: Ep 26 – From Brand Impersonation to Account Takeover: The ATO Attack Chain
The MemcycoFM Show: Ep 25 – How to Detect Brand Impersonation: Key Signals for Security Teams
The MemcycoFM Show: Ep 24 – Real-Time Remote Desktop Takeover Detection and Mitigation
These three attacks are frequently confused. The distinction matters because each requires a different defense.
| Attack Type | How It Works | Credentials Needed | Volume | Detectability |
|---|---|---|---|---|
| Credential Stuffing | Tests real stolen credential pairs across services | Real username + real password (from breach) | Very high | Very low (valid login pattern) |
| Brute Force | Systematically guesses passwords for a known username | Known username only | High | High (many failed attempts) |
| Password Spraying | Tests a few common passwords across many usernames | Valid username list | Low-and-slow | Medium (distributed across accounts) |
Think of credential stuffing as the downstream end of a commodity supply chain. The upstream is a fully industrialized ecosystem that runs 24/7.
- Infostealers are the extraction layer. Lumma Stealer, RedLine, StealC, and newer variants like Acreed infect machines through malicious downloads, pirated software, and phishing links. Once resident, they scrape browser vaults, saved cookies, OAuth tokens, and stored payment data without the user knowing. The resulting log file is a complete snapshot of that person’s digital life.
- Dark web markets and Telegram channels are the distribution layer. Logs are packaged into combolists and sold by geography, email domain, or service type. “Fullz” records that include PII alongside credentials fetch higher prices. Fresh logs from recent infostealer campaigns command premiums over aged database dumps because hit rates are higher.
- Attack tooling is the execution layer. OpenBullet configs targeting specific banking portals, healthcare patient portals, and enterprise SSO systems are sold as ready-to-run modules. A threat actor with no technical skill can buy a combolist, buy a config, and run a credential stuffing campaign against a Fortune 500 in the same afternoon.
Verizon’s DBIR analysis found that compromised credentials were an initial access vector in 22% of the breaches reviewed. Credential compromise is broader than credential stuffing, but it demonstrates the continuing value of stolen authentication data to attackers.
Statistics make the problem legible. Case studies make it real. The security teams responsible for defending these organizations faced a common structural blind spot: server-side detection that couldn’t catch valid authentications.
In late March 2025, coordinated credential stuffing attacks hit five major Australian superannuation funds simultaneously: AustralianSuper, Rest Super, Hostplus, Australian Retirement Trust, and Insignia Financial. Attackers used combolists sourced from prior unrelated breaches.
The Guardian reported that AustralianSuper confirmed stolen passwords were used to access 600 member accounts, with four members losing a combined AUD $500,000. Rest Super saw 8,000 accounts with personal data exposed. The attack escalated to a national security response, with Australia’s Prime Minister noting a cyberattack hits the country approximately every six minutes.
The incident also intensified scrutiny of login protections, including the absence of mandatory MFA for affected member access.
VF Corporation notified customers of credential stuffing attacks against the North Face online store in April 2025. Attackers used credentials from earlier unrelated breaches to access accounts, exfiltrating names, email addresses, shipping addresses, phone numbers, and purchase histories.
This was the fourth credential stuffing incident against VF Corporation brands since 2020. The pattern reflects a structural problem: tens of millions of customer accounts, high password reuse rates, and authentication systems not built to detect low-and-slow validation campaigns.
The most consequential recent example of credential-based initial access. The ALPHV/BlackCat ransomware group entered UnitedHealth’s Change Healthcare subsidiary through compromised Citrix credentials on a remote-access portal that had no MFA enabled. The ransomware deployment shut down healthcare payment processing across the United States for weeks.
UnitedHealth’s CEO confirmed the absence of MFA in Congressional testimony. The total impact exceeded $872 million in direct recovery costs.
In 2024, the threat actor group ShinyHunters used credentials stolen by infostealer malware to access Snowflake customer environments. Over 160 organizations were affected, including AT&T, Ticketmaster, and Santander Bank. None of the Snowflake customer accounts compromised had MFA enabled. AT&T alone paid a $370,000 ransom to prevent stolen call logs from being published.
AI Threat Intelligence vs. Traditional Threat Intelligence: A Practical Guide for CISOs
How Threat Intelligence Automation Helps Security Teams Prioritize External Threats
How Brand Impersonation Leads to Account Takeover (ATO)
- Healthcare: Patient portals, prescription systems, and insurance portals hold a uniquely exploitable combination of PII and financial data. The Change Healthcare breach showed that a single credential can shut down critical national infrastructure.
- SaaS and Enterprise SSO: A single compromised credential in an Okta, Azure AD, or Google Workspace environment gives attackers access to dozens of downstream applications. The Okta breach of 2023, which compromised support system access via stolen credentials, led to attacks on MGM Resorts and Caesars Entertainment.
Credential stuffing isn’t sector-specific. But some industries are structurally more exposed.
- Financial Services: High account balances, stored payment credentials, and wire transfer capabilities make banking and fintech the premium target. NYDFS Part 500’s 2023 amendment mandated universal MFA for any individual accessing any information system precisely because of credential-based breach trends.
- Retail and eCommerce: Stored payment cards, gift card balances, and loyalty points create immediate monetization opportunities. VF Corporation’s repeated victimization is the clearest case study.
- Streaming and Gaming: Lower direct financial value, but high volume and low security friction make these platforms ideal combolist validators. Attackers test credential validity here before targeting higher-value services.
Verizon’s DBIR analysis found that compromised credentials were an initial access vector in 22% of the breaches reviewed. Credential compromise is broader than credential stuffing, but it demonstrates the continuing value of stolen authentication data to attackers.
Why Traditional Defenses Fail
This is the conversation most vendors avoid. Let’s have it.
Residential proxy networks route each credential test through a different home IP address in a different city. There’s no bad actor IP to block. Your blocklist is targeting the wrong end of the problem.
But attackers can use solving services, automation, or human labor to bypass some challenges. They are most effective as one risk-based control rather than a standalone defense.
One login attempt per account, spread across thousands of accounts over 72 hours, generates no anomalous rate signal. By the time your monitoring flags unusual patterns, the attacker has already validated the list.
When a credential stuffing attempt succeeds, the authentication event may appear valid in isolation. Detecting the campaign depends on correlating the browser, device, account, access, and historical signals surrounding that login.
A 16-character, uppercase-lowercase-special-character password can be stolen just as easily as “password123.” Strength requirements protect against brute force. They do nothing against stuffing, which uses the correct password.
This is the detection gap. And it’s why stuffing campaigns are so economically durable.
No single control stops credential stuffing. Defense requires layering. These nine controls, applied together, create a meaningful barrier.
MFA remains the single most effective control. Verizon’s DBIR is explicit: most credential stuffing succeeds because MFA is available but not enforced. Offering MFA is not the same as requiring it.
Priority recommendation: move from opt-in to opt-out, then to mandatory. NYDFS Part 500’s November 2025 deadline already mandates this for all covered financial entities.
Integrate with services like SpyCloud, Have I Been Pwned (HIBP), or proprietary threat intelligence feeds to check submitted credentials against known breach data in real time. If a credential pair appears in a known combolist, step up authentication or force a password reset before the session is established.
Deploy behavioral analytics that score each login session on device fingerprint consistency, mouse movement patterns, keystroke cadence, and session velocity. Legitimate users exhibit behavioral signatures bots cannot fully replicate. Purpose-built bot management platforms flag anomalous sessions for step-up or block.
Deploy behavioral analytics that score each login session on device fingerprint consistency, mouse movement patterns, keystroke cadence, and session velocity. Legitimate users exhibit behavioral signatures bots cannot fully replicate. Purpose-built bot management platforms flag anomalous sessions for step-up or block.
Persistent device fingerprinting builds a behavioral baseline for each user. A login from an unrecognized device, a new browser profile, or an unexpected OS combination triggers step-up authentication, regardless of whether the credential is correct.
Passkeys are the structural fix. A WebAuthn/FIDO2 passkey is bound to a specific device. It cannot be extracted into a combolist. It cannot be stuffed across services. Descope’s DBIR analysis notes passkey logins succeed 3x more often than passwords (98% vs. ~32%) because they eliminate the attack surface entirely.
While residential proxies are difficult to block at the IP level, threat intelligence layers can flag Tor exit nodes, known datacenter ranges, and high-risk ASNs in real time. Combining proxy detection with behavioral scoring catches campaigns that rotate through residential IPs.
Apply Zero Trust principles to post-authentication access. Even a valid credential doesn’t grant unrestricted access. Continuous session validation, micro-segmentation, and least-privilege access limits the blast radius when a credential is compromised.
Alert users immediately when their account is accessed from an unrecognized device or location. Give users a visible session history. Rapid user notification is the fastest path to fraud reversal when a stuffing campaign slips through.
A successful login can appear legitimate when server-side controls evaluate the authentication event in isolation. Detection becomes stronger when account, device, browser, network, behavioral, and historical signals are correlated across attempts.
Browser-level detection adds a correlation point thatIP- or Account-Only Detection may miss. By persistently identifying the device associated with account-access attempts, organizations can detect when the same device tests credentials across multiple accounts, even when attackers rotate IP addresses, distribute attempts over time, or submit valid credentials.
This visibility helps connect successful and failed access attempts to the same suspicious pattern while credential testing is still in progress. Rather than evaluating each login only as an isolated event, browser-level detection can expose the wider campaign across multiple accounts.
| Capability | IP- or Account-Only Detection | Browser-Level Correlation |
|---|---|---|
| Detects repeated failures against one account | Strong | Strong |
| Correlates activity across multiple accounts | Limited | Strong |
| Maintains visibility when IPs rotate | Limited | Strong |
| Connects successful and failed attempts | Variable | Strong |
| Detects low-and-slow credential testing | Limited | Strong |
| Adds persistent device context | Limited | Strong |
This is a core Memcyco differentiator. Memcyco persistently identifies the device associated with account-access attempts and correlates successful and failed activity across customer accounts, even when attackers rotate IP addresses or distribute attempts over time. This provides earlier visibility into suspicious credential-testing patterns while they are still developing.
Regulatory and Compliance Obligations
MitM is frequently conflated with adjacent attack types. The distinctions matter because the right detection approach differs for each.
The New York Department of Financial Services’ 2023 Second Amendment to Part 500 generally requires covered entities to use MFA for individuals accessing their information systems from November 1, 2025, subject to limited exemptions and approved compensating controls Senior leadership is responsible for annual compliance certification or acknowledgement of material noncompliance. NYDFS has levied fines up to $30 million for cybersecurity compliance failures
The FTC’s updated Safeguards Rule requires financial institutions to implement MFA, monitor for unauthorized access, and maintain incident response plans. A credential-stuffing incident may trigger FTC notification when it involves the unauthorized acquisition of unencrypted customer information affecting at least 500 consumers.
Credential stuffing may create notification obligations when it results in unauthorized access to protected personal information and the relevant legal notification threshold is met. In the EU, organizations have 72 hours to notify supervisory authorities. Failure to have adequate technical controls in place can constitute a violation of the security obligations in Article 32 of GDPR.
The SEC’s 2023 cybersecurity disclosure rules require public companies to disclose material cybersecurity incidents within four business days. Public companies must assess credential-stuffing incidents under the SEC’s established materiality standard. If an incident is determined to be material, disclosure is generally required within four business days of that determination.
Many credential-stuffing controls rely heavily on IP reputation, request volume, or repeated failures against the same account. Attackers can weaken these signals by rotating residential proxies, spreading attempts across many accounts, and slowing campaigns to remain below conventional thresholds.
Memcyco adds browser-level visibility and persistent device-based correlation to the detection stack. This enables Memcyco to:
- Detect both successful and failed account-access attempts associated with the same device.
- Associated with the same device across multiple customer accounts.
- Maintain correlation even when attackers rotate IP addresses or distribute attempts over time.
- Generate real-time signals while suspicious credential-testing activity is in progress.
- Extend correlation across login and selected high-risk post-login workflows where Memcyco is deployed.
- Enrich fraud and security workflows with persistent device context and correlated account-access signals.
By correlating account-access attempts at the browser and device level, Memcyco helps organizations detect distributed credential-testing patterns that may not be visible through IP reputation, account-level thresholds, or isolated login events alone. For organizations managing high-value customer accounts, this creates earlier visibility into active campaigns and more context for targeted response.
Ready to see the gap in your current detection stack?
Credential stuffing is not a new threat. It’s an industrialized one. The supply chain is mature. The tooling is commoditized. And the detection gap in most organizations’ defenses is structural, not accidental.
The Verizon DBIR, SpyCloud’s identity research, and every major breach of 2024 and 2025 point to the same conclusion: stolen credentials will find a way in. The question is whether your detection architecture can catch them before the account is compromised, not after.
A layered defense, universal MFA enforcement, breached credential monitoring, behavioral bot detection, and browser-level visibility covers the gaps server-side tools leave open. That’s not a vendor pitch. It’s the minimum viable architecture for protecting customer accounts today.
Credential Stuffing
Remote desktop takeover
Fake e-shops, purchase scams, gift card scams
Get a demo to learn how Memcyco customer :
-
Identify individual scam victims in real-time
-
Predict and preempt ATO incidents
-
Deceive threat actors
What is credential stuffing?
Yes. Blocking remote access tools entirely would disrupt legitimate IT support operations and is not a viable enterprise strategy. Effective detection focuses on real-time indicators that suggest remote-control abuse during interaction with a protected site. This helps organizations identify attacker-controlled access without blocking legitimate remote support tools outright.
What is a combolist?
A combolist is a file containing stolen username and password pairs, typically formatted as email:password. Combolists are compiled from data breaches, infostealer malware logs, and phishing campaigns, then sold or shared on dark web forums and Telegram channels. Attackers load them into automation tools like OpenBullet to run credential stuffing campaigns.
Does MFA stop credential stuffing?
MFA is the most effective single control against credential stuffing, but it must be enforced, not just offered. Verizon's 2025 DBIR found that most successful stuffing campaigns exploit accounts where MFA was available but not required. Some advanced attackers also use MFA bypass techniques like prompt bombing and session cookie theft, which is why MFA should be paired with behavioral detection.
What happened in the Snowflake credential stuffing attack?
In 2024, the threat actor group ShinyHunters used credentials stolen by infostealer malware to access Snowflake customer environments. Over 160 organizations were affected, including AT&T, Ticketmaster, and Santander Bank. None of the compromised Snowflake customer accounts had MFA enabled. AT&T paid a reported $370,000 ransom to suppress stolen data.
What is the success rate of credential stuffing attacks?
Success rates vary widely depending on the freshness of the combolist and the target service's defenses. Industry estimates typically range from 0.1% to 2% per credential tested. While that sounds low, against a combolist of 10 million credentials, a 0.5% success rate means 50,000 compromised accounts.
What tools do attackers use for credential stuffing?
The most widely used tools are OpenBullet and its successor SilverBullet, both originally released as penetration testing frameworks. They automate loading combolists, rotating through residential proxies, and logging valid credentials. Attackers supplement them with custom configuration files (configs) that define the authentication flow for specific target services.
How is credential stuffing different from brute force?
Brute force attacks guess passwords randomly for a known username, generating many failed attempts. Credential stuffing uses real stolen credentials, which means it can succeed on the first attempt with no failed-login noise to alert on. This makes it significantly harder to detect with traditional monitoring.
What regulations require organizations to defend against credential stuffing?
Several frameworks directly address credential-based account takeover: NYDFS Part 500 (mandatory MFA for all financial entities by November 2025), the FTC Safeguards Rule (MFA and access monitoring requirements), GDPR Article 32 (adequate technical security measures), CCPA (data security obligations), and SEC cybersecurity disclosure rules for public companies.
