Credential stuffing
Automated login attempts with username and password pairs leaked from other sites, which succeed wherever people reused passwords (MITRE ATT&CK T1110.004). Phishing-resistant MFA, checks against breached passwords and rate limits keyed to the account and the source defend against it.
Covered in
Guide
Stop account takeover with the right MFA and login defenses
Rank MFA options by the attacks they stop, implement TOTP and push approvals correctly, and close the login, reset and recovery paths that attackers use instead of breaking the second factor.
Guide
Operate edge rules without hiding application defects
Tune WAF and abuse controls against legitimate traffic, parser behavior and measurable business effects.
Practice: Local project: Repair a real proxy and shared cache