Credential Stuffing Attack

How Credential Stuffing Attack Works

Credential stuffing relies on the reality that users often reuse the same credentials across multiple sites. Attackers obtain leaked username/password pairs from data breaches (e.g., Collection #1-5, rockyou2021) and automate login attempts across thousands of target websites. The attack scale ranges from thousands to millions of attempts per day using distributed botnets to evade rate limiting.

Real-World Examples

Impact & Risk Assessment

Credential stuffing causes account takeover, financial fraud, data breaches, and brand damage. Successful attacks lead to direct financial losses (unauthorized purchases, gift card theft), indirect costs (fraud disputes, chargebacks), and loss of customer trust. Organizations face regulatory penalties for inadequate security controls under GDPR, CCPA, and other data protection laws. Account fraud losses reached $20.3 billion globally in 2023, with credential stuffing as the leading attack vector.

How to Detect Credential Stuffing Attack

Monitor authentication logs for patterns indicating automated attacks: high volume of logins from single IP, geographically impossible rapid logins, failed-to-successful login spikes, and simultaneous logins across multiple accounts. Track unique device fingerprints vs. account access. Alert on login attempts using credentials from known breach lists. Analyze user behavior patterns: consistent timing, missing browser telemetry, identical headers across requests. Use CAPTCHA trigger analytics to identify bot behavior.

How to Prevent Credential Stuffing Attack

Require multi-factor authentication (MFA) — this is the single most effective defense, neutralizing 99% of credential stuffing attempts. Implement device fingerprinting and behavioral biometrics to detect automated tools. Deploy intelligent rate limiting (per-IP, per-account, per-device). Enforce unique password policies and check new passwords against known breach lists using services like HaveIBeenPwned. Use a WAF with bot detection to identify credential stuffing tooling. Implement progressive authentication: require additional verification for unusual login patterns, new devices, or high-risk actions. Regularly educate users about password reuse and the importance of unique passwords per service.

Code Examples

import requests
from typing import Optional

def check_password_breach(email: str, password: str) -> Optional[dict]:
    """Check if credentials appear in known breaches via HaveIBeenPwned API"""
    api_url = 'https://haveibeenpwned.com/api/v3/breachedaccount'
    
    try:
        # Check email for breaches (returns list of breaches if found)
        response = requests.get(
            f'{api_url}/{email}',
            headers={'User-Agent': 'YourApp/1.0'},
            timeout=5
        )
        
        if response.status_code == 200:
            breaches = response.json()
            return {
                'found': True,
                'breach_count': len(breaches),
                'message': 'Email found in known breaches'
            }
        
        return {'found': False}
        
    except requests.RequestException:
        return {'found': False}

# Usage in registration flow
if check_password_breach(user_email, user_password)['found']:
    raise ValueError('Email has been compromised in past breaches. Please use a different email.')

const jwt = require('jsonwebtoken');
const speakeasy = require('speakeasy');

async function handleLogin(email, password, ipAddress) {
  // Step 1: Check credentials
  const user = await User.findOne({ email });
  if (!user || !await user.verifyPassword(password)) {
    await logFailedAttempt(email, ipAddress);
    throw new Error('Invalid credentials');
  }

  // Step 2: Check for suspicious activity
  const recentAttempts = await getRecentLoginAttempts(user.id);
  if (recentAttempts.length > 3) {
    // Require MFA for suspicious logins
    if (!user.mfaEnabled) {
      return {
        status: 'mfa_required',
        message: 'Suspicious activity detected. Please enable 2FA.',
        forceSetup: true
      };
    }
  }

  // Step 3: MFA verification (if enabled)
  if (user.mfaEnabled) {
    return {
      status: 'mfa_required',
      userId: user.id,
      message: 'Enter your 2FA code'
    };
  }

  // Step 4: Successful login - issue JWT
  await resetFailedAttempts(email);
  const token = jwt.sign(
    { userId: user.id, email: user.email },
    process.env.JWT_SECRET,
    { expiresIn: '1h' }
  );
  
  return { status: 'success', token, user: safeUser(user) };
}

Frequently Asked Questions

Related Attacks