What is credential stuffing?

• A. Automated testing of large numbers of stolen credential pairs against many sites to gain unauthorized access due to reused passwords.
• B. Manual password guessing on a single site
• C. Encrypting credentials
• D. Creating new login accounts

Answer: (B)

Credential stuffing is an automated attack that uses large lists of stolen username and password pairs to try logging into many different websites. The key idea is that people reuse the same credentials across sites, so a pair stolen from one breach often works on others. Attackers run this at scale with bots, testing thousands or even millions of attempts quickly to gain unauthorized access. It isn’t about guessing a password for a single site manually, nor about encrypting credentials or creating new accounts. The goal is to find existing accounts that use reused credentials and take control of them.