What is Credential Stuffing?

Credential Stuffing is a common Account Takeover technique used to gain brute force access to an account by continually, automatically injecting usernames and passwords into website login forms until they get a match.

Both consumers and businesses are exposed to risks in the instance, with the attacker able to carry out a range of illicit and often fraudulent activity.

24%
Of external attacks were carried out using stolen credential logins in 2018

$5m
Botnets earned per day in 2019

How does Credential Stuffing work?

Credential Stuffing attacks trawl lists of leaked usernames and passwords, using bots to continually test combinations on multiple sites until they are successful.

Usernames and passwords are easily accessible in mass data dumps consisting of millions of credentials amassed from years of data breaches. Although a portion of the data in data dumps is likely to be stale and unusable, there will be plenty of users that have not updated their passwords in some time and whose accounts are open to attack.

Once an attacker has successfully accessed one account, each of the consumer’s accounts using same password are vulnerable to exploitation of the PII it contains. In many cases the PII will be sold on or the account itself will be sold. Whether that’s Spotify and Netflix accounts with prepaid subscriptions or loyalty card schemes.

How to detect Credential Stuffing

Netacea provides a smarter bot management solution that solves the complex problem of credential stuffing in a scalable, agile and intelligent manner, across websites, mobile apps and APIs.

Our technology monitors all site visits to a specified path and analyses them in context relative to each of the visitors to the enterprise estate. The technology the automatically learns from the business’s web estate according to the specified priorities and threats it faces.

How to prevent a Credential Stuffing attack

At Netacea, we understand bot behaviour better than anyone else, thanks to a pioneering approach to detection and mitigation. Our Intent Analytics engine, powered by machine learning, focuses on what the bots are doing and not just how they are doing it, so malicious bots are hunted our and genuine users are always prioritised.

We are then able to dynamically assess what constitutes “normal” behaviour over time, by path or location within the website. This allows us to build an accurate model in the context of actual behaviour, while providing you with the actionable intelligence you need, when you need is, so you’re empowered to make smarter decisions about your traffic.