In June 2026, Cybernews researchers found an open database containing roughly 24 billion stolen credentials, mostly from infostealer malware logs and recycled breach data. The records included usernames, plaintext passwords, and the exact login URLs they belong to, all packaged and ready for automated attacks.
So what is credential stuffing? Criminals take username-and-password pairs stolen from one breach and automatically test them against login pages for completely unrelated services. Your old shopping site password becomes the key to your bank account, your email, and your retirement fund. According to the 2025 Verizon Data Breach Investigations Report, stolen credentials drove 22% of all confirmed breaches, making compromised logins the single most common way attackers got in.
The attack pipeline behind credential stuffing is now fully industrialized. Here's how credential stuffing works, why reused passwords are the structural flaw that keeps it alive, and the four-layer defense that can shut it down.
Key takeaways
- Credential stuffing uses real stolen passwords, not guesses, making strong passwords useless if reused across accounts
- A single database discovered in June 2026 contained roughly 24 billion stolen credentials ready for automated attacks
- Stolen credentials drove 22% of all confirmed breaches in 2025, according to Verizon
- The four-layer defense: unique passwords, masked email aliases, TOTP two-factor authentication, and hardware security keys
The Credential Stuffing Attack Pipeline
A credential stuffing attack runs on three components: a supply of stolen credentials, automation software to test them, and proxy networks to stay invisible. Each piece is cheap, widely available, and requires almost no technical skill to operate.
Where stolen credentials come from
Criminals don't hack your accounts directly. They start with massive collections of stolen username-and-password pairs called combolists, compiled from multiple sources:
- Infostealer malware logs: Malware silently pulls saved passwords, session cookies, and autofill data from web browsers on infected devices
- Past data breach dumps: Credentials from old breaches get repackaged and resold, sometimes years after the original incident. Your exposed personal information on people-search sites can also end up bundled into these lists
- Cybercrime forums and Telegram channels: Successor communities to seized forums like RaidForums openly trade fresh combolists, often sorted by service type or geography
The 24 billion credentials Cybernews discovered in June 2026 came from at least 36 separate sources, including hacking-focused Telegram channels, older breach compilations, and live infostealer collections that were still being updated.
How attackers test stolen passwords at scale
Credential stuffing is almost entirely automated, and understanding how hackers use leaked passwords starts with the tooling. Once attackers have a combolist, they feed it into credential-stuffing frameworks like OpenBullet or SilverBullet. Originally built as penetration-testing utilities, these tools now serve as standard equipment for account takeover attacks. The software loads combolists, sends login requests that mimic real browser behavior, and logs every successful hit.
Attackers also buy and sell custom configuration files that define the login flow for a specific target. The success rate on any single attempt may be between 0.1% and 2%, but across millions of credentials, that unlocks thousands of accounts.
How attackers stay invisible
Websites can block login attempts that come from the same IP address too many times. Credential stuffing tools get around this by routing each attempt through a different IP address using rotating proxy networks. Residential proxies borrow IP addresses from real consumer devices, making automated traffic look like normal logins from real users. Standard rate-limiting defenses often can't tell the difference.
Why Reused Passwords Are a Structural Vulnerability
Combos with billions of credentials are useless if every password in them is unique to one account. Password reuse is the single structural flaw that makes the entire credential stuffing pipeline profitable.
One reused password opens every door
Say you signed up for a food delivery app three years ago using your regular email and the same password you use for your bank. That delivery app gets breached, and your credentials end up in a combolist. An attacker's bot tries that combination on your bank's login page, and it works.
Verizon's analysis found that only 49% of a user's passwords across different services are distinct. The other half are repeats, and each reused password is another door an attacker can open without targeting you personally.
In March 2025, attackers simultaneously hit five major Australian retirement funds using combolists from older breaches. Four AustralianSuper members lost a combined AUD 500,000, and none of those funds were hacked directly. Attackers simply replayed credentials that members had reused from other services. Without identity theft coverage, victims in cases like these often bear the full financial loss.
Password variations don't help much
Adding a "1" to the end or swapping a letter for a symbol may not be enough. Some credential stuffing tools can test common variations as part of their automated runs. Passwords like "Summer2024" and "Summer2024!" are close enough that both could end up compromised in the same run.
You can't know every breach
Data breaches happen constantly, and many go unreported for months or years. Your credentials may already be sitting in a combolist from a breach you never heard about. Monitoring services that scan leaked credential databases can alert you when your information surfaces.
Run a free safety scan to see how many of your credentials are already exposed.
The 4-Layer Defense Stack Against Credential Stuffing
Stopping credential stuffing means breaking every link between your accounts. No single layer is enough on its own, but stacking all four makes account takeover attacks far less likely to succeed.
Layer 1: Unique passwords for every service
Every unique password kills the credential stuffing chain for that account. If your bank, email, and shopping accounts all use different passwords, a breach at one service stays contained. A password manager generates and stores random passwords so you don't have to remember them.
A password manager is a good starting point, but on its own, it only covers one layer. The real defense comes from stacking every layer below it.
Layer 2: Masked email aliases that kill the username vector
Your email address is the other half of every login. When you use the same email across every service, a leaked password from one site gets tested against that email on dozens of others. Even with unique passwords, a shared email address tells attackers exactly where to aim.
Unique email aliases give each account a separate address that forwards to your real inbox. An attacker who gets your alias from a retailer breach can't connect it to your bank or anything else. The credential stuffing chain breaks before the attacker even gets to try a password.
Layer 3: TOTP two-factor authentication replacing SMS
Two-factor authentication (2FA) adds a second verification step after your password. Even if an attacker has your correct credentials, they can't get in without that second code.
Not all 2FA is equal. SMS codes can be intercepted through SIM swap attacks, where a scammer tricks your carrier into transferring your number to their device. Time-based one-time passwords (TOTP) from authenticator apps like Google Authenticator or Authy generate codes locally on your device instead of routing them through your carrier's network, and each code expires in 30 seconds. Replacing SMS with TOTP closes a gap that credential stuffing attackers have learned to exploit.
Layer 4: Hardware security keys and passkeys for high-value accounts
For accounts that matter most, banking, primary email, crypto, and work logins, hardware security keys provide the strongest protection widely available. A physical key like a YubiKey requires you to tap the device during login. Phishing sites can't replicate that interaction because the key verifies the actual website domain before responding.
Passkeys, now supported by Google, Apple, and Microsoft, bring a similar level of protection without carrying a separate device. Passkeys use your phone or laptop's built-in biometrics to verify your identity. Either option makes credential stuffing and sophisticated phishing attempts far less likely to work on the accounts you can't afford to lose.
How Cloaked Helps You Stay Ahead of Credential Stuffing
Credential stuffing works because attackers can connect your identity across services. Cloaked is useful here in a straightforward way. You can generate unique email and phone aliases for every account, eliminating the shared email address that credential stuffing depends on. Cloaked also removes your personal data from 300+ people-search and data broker sites, cutting off a major source of the personal information attackers use to build combolists. Add dark web and SSN monitoring to catch leaked credentials early, plus $1M in identity theft insurance, and you've got a layered defense built for the way these attacks work today.
Take a safety scan and see how exposed your accounts already are, or contact us to learn more.
FAQs
What is credential stuffing in simple terms?
Credential stuffing is when attackers take stolen usernames and passwords from a data breach at one company and automatically test those same login combinations against other websites. The attack works because many people reuse the same password on multiple accounts. No hacking or password guessing is involved.
How is credential stuffing different from brute force and password spray attacks?
Brute force attacks guess passwords using random combinations. A password spray attack tries one common password against thousands of accounts on a single service. Credential stuffing uses real stolen login pairs from a previous breach. Password strength stops brute force and spraying, but only uniqueness stops credential stuffing.
Can a strong password protect you from credential stuffing?
Not on its own. A strong password is useless if you've reused it on another site that gets breached. Real protection requires stacking defenses: a unique password per service, a unique email alias per account, TOTP-based two-factor authentication, and passkeys on high-value accounts.
How do you know if your credentials have been leaked?
Services like Have I Been Pwned let you search your email to check if it appeared in known breaches. Monitoring tools that scan dark web marketplaces can also alert you when your login information surfaces. Changing the affected password quickly limits the damage.
Why don't websites just block credential stuffing attacks?
Credential stuffing bots are designed to look like normal logins. Each attempt uses a real username-and-password pair from a different IP address, making it hard for websites to distinguish attackers from real users. Rate limiting and CAPTCHA challenges help but can't catch every automated attempt.
What should you do right away if your account gets taken over?
Change the password on the compromised account immediately, then update it on any other account where you reused it. Enable two-factor authentication and check for unauthorized purchases or changes. Report the incident to the company's support team, and contact your bank if financial accounts were affected.
