What Credential Stuffing Is and How to Reduce the Risk
Summary
Credential stuffing uses automated login attempts with previously exposed email-and-password pairs. The article describes reported examples and recommends unique passwords, a password manager, and MFA for users, plus rate limiting and monitoring for websites.
Key points
- Credential stuffing tests stolen or exposed email-and-password combinations against other services, exploiting password reuse.
- The article says a June 2025 customer notice from The North Face reported information stolen in an April 23 credential-stuffing attack, including names, purchase histories, contact details, birth dates, and shipping addresses.
- The article reports that Atlantis AIO automates credential-stuffing attacks against more than 140 services and includes brute-force, CAPTCHA-bypass, and account-recovery features.
- Cracked[.]io and Nulled[.]to were seized in January during the international law-enforcement operation Operation Talent; the article describes the forums as linked to cybercrime, including credential stuffing.
- Recommended user protections include MFA, unique passwords for every account, and using a password manager.
- For websites, the article recommends rate limiting, advanced CAPTCHAs, and monitoring for suspicious behavior.
Article Details
- Topic
- Credential stuffing
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | cracked[.]io | Forum identified as hosting cybercriminal activity, including credential stuffing attacks; the article reports it was seized. |
| DOMAIN | nulled[.]to | Forum identified as hosting cybercriminal activity, including credential stuffing attacks; the article reports it was seized. |
| DOMAIN | starkrdp[.]io | Remote desktop hosting service allegedly leveraged by threat actors to anonymize attacks; the article reports it was seized. |