Credential Stuffing Bot

A credential stuffing bot is used to test previously leaked credentials (typically username and password pairs) to determine if they are valid on a target webservice or API. These bots validate credential pairs against their target webservice or API by automating login attempts, allowing adversaries to test and validate credentials at mass scale.

Show Techniques

Hide Techniques

Resource Development 3 Tactics

Credential Acquisition

• Data Dumps

Infrastructure Acquisition

• Botnet
• Command & Control
• Proxies

Tool Development

• Development of Tools
• Campaign Reuse

Reconnaissance 1 Tactics

Specific Target

• Technical Reconnaissance

Defence Bypass 4 Tactics

Mitigation Bypass

• CAPTCHA Farm
• Automated CAPTCHA Bypass
• MFA Bypass

Human Emulation

• User Agent Spoofing

Proxying

• Botnet
• User Agent Spoofing
• IP Rotation

Smokescreening

• Volumetric Traffic Disguise
• Target Diversification

Attack Execution 1 Tactics

Account Takeover

• Credential Stuffing

Actions on the Objective 1 Tactics

Exfiltration

• Credential Dumping

Post-Attack 1 Tactics

Sale

• Information Brokerage
• Automated Sale
• Manual Sale