Credential stuffing

Credential stuffing is an automated attack that tests username-and-password pairs exposed in one breach against login systems at other services, exploiting password reuse.

Credential reuse: Using the same password, or a small set of passwords, across multiple accounts. Reuse makes a password exposed at one service useful for attacking accounts elsewhere.
Data breach: An incident in which protected or sensitive information is accessed or disclosed without authorization. Breaches can expose the username-and-password pairs that seed stuffing campaigns.
Rate limiting: A control that restricts how frequently a user or system can make requests. Login limits can slow repeated attempts, though distributed attackers may evade basic limits.
Identity theft: Unauthorized use of another person's identifying information for deception or gain. Taken-over accounts can expose personal data that supports further impersonation.
Credential cracking: Recovering passwords from password hashes through guessing and computation. Unlike stuffing, cracking derives passwords from hashes rather than replaying known pairs.
Password hash: A fixed-length value produced by applying a one-way cryptographic function to a password. Some breach dumps contain hashes rather than plaintext passwords, changing what attackers can reuse directly.
CAPTCHA: A challenge-response test intended to distinguish human users from automated programs. Challenges can interrupt automated login attempts, especially when risk signals are elevated.
Financial fraud: Deception used to obtain money or financial benefit unlawfully. Compromised banking, shopping, or payment accounts can enable unauthorized transactions.
Botnet: A network of internet-connected devices remotely controlled as a group. Distributed devices can spread login attempts across many addresses and evade simple rate limits.
Password manager: Software that securely stores and fills account credentials, often generating unique passwords. Unique generated passwords prevent one leaked credential from unlocking unrelated accounts.

Linked from 6 pages