# What is credential stuffing?

Credential stuffing is attackers taking e-mail and password pairs leaked from other websites and trying them automatically on your logins, betting that people reuse passwords. It targets internet-facing services, such as webmail, VPN, customer portals and cloud applications, and comes from many addresses at once, so it often looks like a normal mix of logins with a slightly higher failure rate. The defences are multi-factor authentication (MFA), a policy against password reuse, checking company addresses against known breach collections, and rate limits on login pages. For your customers' accounts, offer MFA and watch for many failed logins across accounts. A network sensor inside your company sees little of this, because it happens at your public services or at a cloud provider. NetSenX sees what a successful login is used for afterwards, if it leads to activity on your internal network.

FAQ: [Attack techniques explained](https://netsenx.com/en/faq/attacks) · https://netsenx.com/en/faq/what-is-credential-stuffing

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/is-someone-inside-your-network

## Related questions

- [What is Kerberoasting?](https://netsenx.com/en/faq/what-is-kerberoasting)
- [What is pass-the-hash?](https://netsenx.com/en/faq/what-is-pass-the-hash)
- [What is a drive-by download?](https://netsenx.com/en/faq/what-is-a-drive-by-download)
- [What is a botnet, and how would we know a device of ours is part of one?](https://netsenx.com/en/faq/what-is-a-botnet)
- [What is a remote-access trojan (RAT)?](https://netsenx.com/en/faq/what-is-a-remote-access-trojan)