Credential stuffing tests a large collection of previously stolen username-and-password pairs against one targeted service. It works because people often reuse credentials across websites. section 1.2
A reused-password attack
After obtaining a database of stolen passwords, an attacker retries the collection against a single website. This differs from password spraying, which tests stolen credentials across many websites. section 1.2
The surrounding attack chain can include:
- Stealing credentials in bulk by accessing and downloading a database. section 1.2
- Using compromised social-media accounts for scams or selling harvested credentials to other attackers. section 1.2
