Credential stuffing

Credential Stuffing refers to the automated attempt to access a protected system by using a large series of stolen username and password combinations, usually obtained as the result of data breaches.

Attempts are made, often by a botnet, to access the system using these stolen username and password pairs, until one or more of them is found to grant access, at which point the system has been compromised.

Credential stuffing may be used as a strategy to steal from a large number of end users (for example, on a banking website) or as a strategy to gain access to an account with elevated privileges on a single critical system.