What is credential stuffing?
Credential stuffing is attackers taking e-mail and password pairs leaked from other websites and trying them automatically on your logins, betting that people reuse passwords. It targets internet-facing services, such as webmail, VPN, customer portals and cloud applications, and comes from many addresses at once, so it often looks like a normal mix of logins with a slightly higher failure rate. The defences are multi-factor authentication (MFA), a policy against password reuse, checking company addresses against known breach collections, and rate limits on login pages. For your customers' accounts, offer MFA and watch for many failed logins across accounts. A network sensor inside your company sees little of this, because it happens at your public services or at a cloud provider. NetSenX sees what a successful login is used for afterwards, if it leads to activity on your internal network.