Credential-Stuffing Threat Intensifies Amid Password Reuse

Employees who reuse logins on multiple websites drive the impact of third-party breaches as hackers use credential stuffing to compromise more accounts.

Password reuse poses a tremendous security risk as attackers increasingly employ leaked credentials to search for other accounts to compromise via reused passwords.
Theres no shortage of leaked credentials for attackers to employ. Nearly all (97%) of the worlds 1,000 largest companies have had corporate credentials exposed, Digital Shadows reports in its newly published
research
on account takeover attacks and mitigation.
Hackers are using this information in six main ways: for building botnets, post-breach extortion, credential harvesting, spearphishing, account takeover, and credential stuffing. This research specifically dives into account takeover, which is increasing with credential-stuffing tools.
Credential stuffing is the process of using automated systems to brute-force a website with login information stolen from another site, hoping it will match with an existing account. Its easy for attackers to automate account takeover by identifying where users employ the same credentials on multiple sites, and spreading their attack to more accounts.
Barriers to entry have gotten lower and lower, says Michael Marriott, research analyst at Digital Shadows, of account takeover attacks. Threat actors dont need advanced expertise to infiltrate accounts, and theyre realizing users poor security habits will drive their success. With an obscene amount of data available online, theyre likely to find a match, he says.
Many credentials are publicly available; cost varies depending on their age. For example, Digital Shadows reports the LinkedIn database cost $2,280 in April 2016: now, you can buy it for a mere $4. One of the most thorough packages costs $2,999 for a total of 3,825,302,948 credentials collected from 1,074 databases.
Attackers use a few different tools to launch credential stuffing attacks, but the main ones are SentryMBA, Vertex Cracker, and Account Hitman. Marriott says the most popular is SentryMBA, which is free and designed to bypass the CAPTCHA controls implemented to stop automated logins.
There are different motivations, but making money is an obvious one, says Marriott of whats driving these attacks. People also use account takeover to find out more information about users. If you want to tailor an attack more, you can log on to different accounts.
Technically skilled people can make money by selling a websites configuration files, which maps out the specific parts of a site so credential-stuffing software knows where to attempt logins. Those who dont have the tech-savvy to create these files can buy them on forums, marketplaces, and social media.
Credential stuffing affects businesses of all sizes and industries across the board. Gaming and technology businesses were most frequently targeted, but attackers also went after gift card companies, hotels, pizza shops, and online retailers. The most vulnerable websites are those with an employee or customer login page, which are open to account takeover attempts.
Multi-factor authentication is one means of fighting account takeover attacks; however, Marriott warns against using this as a silver bullet to get full protection.
If [businesses] dont have multi-factor authentication, its not because they havent thought about it, he explains. Oftentimes companies decide against it because it leads to loss of customers; in some cases, like with SMS authentication, it may not even be that effective.
There are other ways to detect and protect against account takeover attempts. Marriott recommends companies check
Have I been pwned
for signs of email compromise, and use Google Alerts to check for mentions of company and brand names across cracking forums. This will give you a heads-up if someone is discussing a potential attack on your business.
He also advises organizations to learn more about credential-stuffing tools and inform staff and consumers of the dangers of reusing passwords and corporate email addresses for personal accounts.
Related Content
9 Ways Organizations Sabotage Their Own Security: Lessons from the Verizon DBIR
With Billions Spent on Cybersecurity, Why Are Problems Getting Worse?
Staying a Step Ahead of Internet Attacks

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Credential-Stuffing Threat Intensifies Amid Password Reuse