Credential stuffing exploits humanity's most dangerous security habit: password reuse. Attackers acquire billions of username/password pairs from prior data breaches, then automate login attempts across hundreds of sites simultaneously - turning one breach into unlimited account compromises.
The raw material for credential stuffing is stolen from prior data breaches - not from the target site. Attackers purchase compiled breach databases on dark web markets for as little as $10, or freely download them from Telegram channels and public paste sites. The quality varies: older breaches have higher reuse potential, newer ones have fresher accounts.
Raw breach dumps are messy - multiple formats, duplicates, cracked hashes mixed with plaintext, and irrelevant domains. Before attacking a streaming site, the attacker cleans and filters the data: extract only email:password pairs, deduplicate, remove known-invalid entries, and optionally filter to accounts likely to exist on the target platform.
Modern stuffing tools like OpenBullet2 use "configs" - site-specific scripts that define the exact HTTP requests, response parsing logic, and success/failure detection rules for each target. Configs are bought, sold, and shared in dedicated underground communities within hours of new targets being scoped. Setup takes under an hour.
With the tool configured and combo list loaded, the campaign runs autonomously. 512 concurrent threads each maintain their own session, proxy, and cookie state. Successful logins are instantly logged with the captured access token. The tool automatically handles retries, proxy rotation on rate limits, CAPTCHA solving, and session management - no manual intervention needed.
Raw hits are automatically triaged by the stuffing tool: subscription tier, stored payment methods, profile data, and linked accounts are extracted from the authenticated session. High-value accounts (saved credit cards, premium subscriptions, high loyalty balances) are separated and sold at premium. The validated hit list is then packaged for sale or immediate use.
Compromised accounts are monetized through multiple channels simultaneously. A single large-scale stuffing campaign generates revenue across dark web sales, direct fraud, and downstream attacks. The economics are compelling - $45 spent on breach data can yield tens of thousands of dollars in a single run with minimal operational risk to the attacker.
Credential stuffing leaves a distinct signature in authentication logs - a sharp spike in failed login attempts, often from thousands of unique IP addresses, targeting valid accounts with incorrect passwords. The challenge: at 847 req/sec spread across 50,000 proxy IPs, each individual IP looks like a single user making a single login attempt. Behavioral analytics across the full population is required.
| Site Category | MFA Adoption | Bot Protection | Stuffing Success Rate | Attack Volume | Attacker Priority |
|---|---|---|---|---|---|
| Online Banking | High (70%+ mandated) | Advanced (behavioral) | 0.1β0.3% | HIGH - automated | CRITICAL - high payout |
| Streaming Services | Low (optional) | Moderate (rate limits) | 0.5β1.5% | VERY HIGH | HIGH - volume resale |
| E-Commerce / Retail | Very Low (optional) | Basic (CAPTCHA only) | 1β3% | VERY HIGH | CRITICAL - saved cards |
| Corporate SaaS / Email | Moderate (conditional) | Good (Azure AD / Okta) | 0.2β0.8% | HIGH | CRITICAL - BEC pivot |
| Airline / Hotel Loyalty | Low (optional) | Weak | 1β4% | HIGH | HIGH - points fraud |
| Gaming Platforms | LowβModerate | Basic | 1β5% | VERY HIGH | MED - item/currency resale |
| Healthcare / Insurance | Growing (HIPAA pressure) | Moderate | 0.3β0.9% | MEDIUM | CRITICAL - PII value |