1) Credential Stuffing Imagine you’re a hacker buying 100,00 | Cybrary.it

1) Credential Stuffing

Imagine you’re a hacker buying 100,000 usernames, emails, and passwords on the dark web. By the way, those credentials were probably hacked from a weak website, blog, or e-commerce site and then sold on the dark web.

Next, you start testing those credentials against other databases to see if there’s a match. For example, you could get your list and start testing it against banks, merchants, and other websites. Once you find a match, you’re in.

Furthermore, all of this can be automated. There are tools that test stolen credentials across multiple sites allowing hackers to quickly breach new accounts even on sites with good security.

It’s estimated that tens of millions of accounts are tested each day with the credential stuffing technique.