What is credential stuffing?
Credential stuffing takes username and password pairs stolen from one breached site and tries them against other sites, betting that people reuse passwords. The attacker is not guessing; they are replaying known-good combinations. Because huge breach dumps are freely traded, and because reuse is common, stuffing works at scale, and attackers run it through botnets and proxies so the attempts come from thousands of addresses.
How it works
An attacker loads millions of leaked pairs into automation and submits them to a target's login page, VPN or API. Where a victim reused the same email and password, the login succeeds. Each account is usually tried only once or twice, so no lockout trips, and successes appear scattered among the failures. The attack stops touching an account as soon as it gets in.
How it looks in practice
In the logs, stuffing shows logins from many IP addresses and odd geographies, a mix of failures and occasional successes, and automated timing. The requests often share a thin or identical user agent string. A spike in logins from new devices and locations, with a small but real success rate, is the pattern. It overlaps with impossible-travel and new-device alerts when a stuffed account is then used.
How to defend against it
Multifactor authentication is the strongest control, because a reused password alone no longer completes a login. Beyond that: check new and reset passwords against breach-corpus lists so known-leaked passwords cannot be set, add bot detection and device fingerprinting to spot automation, apply rate limiting and challenges such as CAPTCHA to slow the flood, and use velocity rules that fire when one account is tried from many places. The root cause is password reuse, which unique passwords and a password manager address directly.
Credential stuffing vs. password spraying
Both target many accounts, but the input is different. Credential stuffing replays real, previously breached pairs and leans on reuse. Password spraying guesses a few common passwords against many accounts to dodge lockout. If the scenario mentions leaked or reused credentials from a prior breach, the answer is credential stuffing.
Credential stuffing on the CompTIA Security+ exam
Credential stuffing is an indicator of malicious activity under objective 2.5. Scenario wording about attackers using passwords from a third-party breach, logins succeeding because a user reused a password, or automated attempts from many addresses points at it. The distractors are password spraying, which uses guessed common passwords, and a brute-force attack against one account. Multifactor authentication and breached-password checks are the defenses the exam rewards.