Credential Stuffing Defense: Detection Logic and Controls That Work

Credential stuffing is the automated replay of usernames and passwords stolen from one service against the login pages of another.

It succeeds because people reuse passwords, and it scales because bots and residential proxies are cheap.

This guide is written for defenders. It explains how a modern campaign is assembled, which log signals reveal it, sample detection queries mapped to MITRE ATT&CK T1110.004, and the controls that cut success rates, from rate limits and bot mitigation to passkeys.

It closes with an incident response runbook.

What credential stuffing is (and how it differs from brute force)

MITRE ATT&CK catalogs the technique as T1110.004 Credential Stuffing, a sub-technique of Brute Force, and describes adversaries using credential pairs from breach dumps of unrelated accounts.

OWASP’s Automated Threats project separates OAT-008 Credential Stuffing (known pairs from elsewhere) from OAT-007 Credential Cracking (guessing).

The distinction matters for detection. Brute force produces many attempts against one account. Credential stuffing produces one or two attempts against many accounts, often with valid usernames, so per-account lockout thresholds rarely fire.

Technique	ATT&CK ID	Attempt pattern	Typical tell
Password guessing	T1110.001	Many passwords, one account	Account lockouts
Password spraying	T1110.003	One common password, many accounts	Same password hash across failures
Credential stuffing	T1110.004	Unique leaked pair per account	High failure ratio, many usernames per source

How a credential stuffing campaign works

1. Sourcing combo lists

Attackers start with combo lists: text files of email and password pairs compiled from old breaches and, increasingly, from infostealer logs. In 2025 a researcher found an exposed database of about 184 million login pairs, likely harvested by infostealers, which shows how much fresh material feeds credential-stuffing operations.

Infostealers and remote-access trojans such as GravityRAT are part of the wider set of malicious activities on the internet that keep these lists current.

2. Configuring the tooling

Off-the-shelf “checker” tools take a config file per target site describing the login request, success and failure strings, and CAPTCHA handling. Traffic is spread across residential proxy pools so each IP sends only a few requests.

3. Validating and monetizing

Valid accounts (“hits”) are sorted by value: stored payment cards, loyalty points, gift balances, wallet funds or access to corporate SSO.

Consumer brands with points or stored value are frequent targets, as in the 2025 North Face credential stuffing attack and a 2026 incident in which Chick-fil-A told customers to reset loyalty account passwords.

Any platform that holds balances or promotional credit, whether retail rewards or offers like Online Casino Canada bonuses, gives attackers something to cash out.

How big the credential stuffing problem is

Verizon’s 2025 DBIR research on credential stuffing found that, in single sign-on provider logs, the median daily share of authentication attempts that were credential stuffing was 19%.

That rose to 25% for enterprise-sized organizations, with a single-day peak of 44%. Compromised credentials were the initial access vector in 22% of breaches in the 2025 DBIR, and infostealer data showed only 49% of a typical user’s passwords were distinct across services.

Cloudflare data reported by Cyber Security News found that 41% of successful logins across its protected websites involved previously leaked passwords (2025), and that 95% of login attempts using leaked passwords came from bots.

Older industry roundups, such as TechTarget’s list of statistics on The annual average cost of cybercrime, framed account compromise as a cost problem years ago. The current data shows the volume has not gone down.

Detecting credential stuffing in your logs

Good detection looks at the population of logins, not single accounts. MITRE’s detection strategy for T1110.004 (DET0460) focuses on many failed logins with distinct username and password pairs from one source and rapid failures across users.

Signals to baseline

• Login failure ratio per minute across the whole application.
• Distinct usernames per IP, ASN, device fingerprint or TLS fingerprint (JA3/JA4).
• Share of attempts for usernames that do not exist (attackers’ lists are stale).
• Logins from hosting or residential proxy ASNs that rarely appear for your users.
• Successful logins followed quickly by profile, email, payout or payment method changes.

Example detection query (Splunk SPL, illustrative)

index=auth sourcetype=web_login earliest=-15m
| stats count AS attempts,
        dc(username) AS users,
        sum(eval(if(result=”failure”,1,0))) AS failures,
        sum(eval(if(reason=”unknown_user”,1,0))) AS unknown_users
  BY src_ip, ja4_fingerprint
| eval fail_ratio = failures / attempts
| where users >= 20 AND fail_ratio >= 0.8 AND unknown_users >= 5
| sort – users

Example post-login query (KQL, Microsoft Entra ID, illustrative)

SigninLogs
| where TimeGenerated > ago(1h)
| summarize Users = dcount(UserPrincipalName),
            Failures = countif(ResultType != “0”),
            Successes = countif(ResultType == “0”)
  by IPAddress, AutonomousSystemNumber
| where Users > 25 and Failures > Successes * 10

Thresholds are starting points; tune them against your own baseline. Alert on the successes from flagged sources first, because those are the compromised accounts.

Watch the endpoints attackers move to

When the main login page gets harder to attack, campaigns shift to weaker paths. Mobile app APIs, legacy authentication endpoints, partner portals and password reset flows often lack the bot controls applied to the web login.

Inventory every endpoint that accepts a credential or reveals whether an account exists, and apply the same logging and rate limits to each.

Account enumeration is the usual giveaway. If your sign-up page says “email already registered” or your reset page says “no account found”, attackers can clean their combo lists before stuffing. Return neutral messages and send the detail by email instead.

Credential stuffing against corporate SSO

The same technique hits workforce identity. Verizon’s figures above come from SSO provider logs, and MITRE notes that targets include cloud applications, externally facing email and remote services.

For employees, the defenses are conditional access policies that block legacy protocols, phishing-resistant MFA for all users, and alerts when a single source fails against many accounts in your identity provider.

Treat a successful login from a flagged source as an incident, not a ticket.

Enrich with threat intelligence

Feed known proxy and hosting ASNs, checker-tool fingerprints and leaked-credential alerts into the detection pipeline.

Breach monitoring services can tell you when your users’ emails appear in new dumps, which lets you force resets before the list is used against you.

Controls that stop credential stuffing

Bot mitigation and rate limiting

Rate-limit by more than IP: combine IP, ASN, device and TLS fingerprints, and username. Bot mitigation should challenge or slow suspicious sessions rather than return a clear “wrong password” signal, which helps attackers validate lists.

Return identical responses and timing for unknown users and wrong passwords.

Breached-password screening

NIST SP 800-63B-4 (July 2025) sets the US federal baseline for authenticators; check new and changed passwords against a list of known-compromised values. Screening at login, and forcing a reset when a match appears, removes the pairs attackers rely on.

Multifactor authentication and passkeys

MITRE lists M1032 Multi-factor Authentication as a primary mitigation. Even basic multifactor authentication turns a valid password into a failed takeover in most cases, though one-time codes can still be phished.

Passkeys (FIDO2/WebAuthn) remove the reusable password altogether. Large providers are moving this way: Microsoft announced that passkeys become the default Entra ID sign-in method, with SMS and voice delivery being retired.

Risk-based authentication

Score each login on device novelty, location, network reputation and behavior. Step up to MFA only when risk is elevated so legitimate users are not challenged every time.

Control	Framework mapping
MFA / passkeys	ATT&CK M1032; CIS Controls v8 6.3-6.5; NIST CSF 2.0 PR.AA
Breached-password screening	ATT&CK M1027; NIST SP 800-63B-4
Rate limiting and bot mitigation	OWASP OAT-008 countermeasures; NIST CSF 2.0 PR.PS
Login anomaly detection	CIS Controls v8 8 (audit logs); NIST CSF 2.0 DE.CM

Incident response runbook for a credential stuffing attack

Illustrative runbook. Adjust owners and thresholds to your environment.

1. Detect and scope: confirm the spike with the queries above and list every account that logged in successfully from flagged sources.
2. Contain: enable stricter bot challenges on login, tighten rate limits, and block the worst ASNs or fingerprints temporarily.
3. Protect accounts: invalidate sessions and force password resets for compromised accounts; freeze payout, gift card and stored-value redemption for them.
4. Investigate abuse: review changes made after login (email, address, payment methods) and reverse fraudulent orders or transfers.
5. Notify: inform affected users with clear advice to use unique passwords and enable MFA; assess legal notification duties.
6. Improve: add breached-password screening, offer passkeys and convert the attack’s indicators into permanent detections.

Key takeaways

• Credential stuffing (T1110.004) replays leaked pairs across many accounts, so per-account lockouts rarely catch it.
• Verizon’s 2025 data puts the median share of SSO authentication attempts that are credential stuffing at 19%.
• Detect at population level: distinct usernames per source, failure ratio and unknown-user attempts.
• Combine bot mitigation, breached-password screening and risk-based MFA; passkeys remove the reused password entirely.
• During an attack, prioritize accounts that logged in successfully and freeze value withdrawal for them.

FAQ

What is a credential stuffing attack?

It is an automated attack where criminals take username and password pairs leaked from one site and try them on other sites, betting that users reused the same password.

How do you detect credential stuffing?

Look for many distinct usernames from one IP, ASN or device fingerprint, a high login failure ratio, attempts against non-existent accounts, and successful logins followed by quick account changes.

What is the difference between credential stuffing and password spraying?

Credential stuffing uses a specific leaked password for each account. Password spraying tries one or a few common passwords across many accounts.

Does MFA stop credential stuffing?

MFA blocks most takeovers because a valid password alone is not enough, but one-time codes can be phished. Passkeys provide stronger, phishing-resistant protection.

What are combo lists?

Combo lists are files of email or username and password pairs compiled from breaches and infostealer logs, used as input for credential stuffing tools.