Attackers take huge lists of usernames and passwords leaked from other websites and automatically try them on your login page. Because most people reuse passwords, a surprising number of these attempts succeed — without the attacker ever having to guess anything.
Think of it this way
Imagine someone found a keyring dropped on the street with 50 keys and a label saying 'works on Gmail and Facebook'. They walk up to your front door and try every key in the ring. Credential stuffing is exactly that — keys stolen from someone else's breach being tested against your lock.
Data breaches happen constantly. When a company is hacked, their user database — emails and (often poorly hashed) passwords — ends up for sale on the dark web. Attackers buy these lists, which can contain hundreds of millions of credentials. They run automated tools that fire login attempts against your API, using the real email and password combinations from those breaches. The success rate is typically 0.1–2%, but on a list of 10 million credentials that is still up to 200,000 compromised accounts.
Scenario 1
An attacker uses a list of 2 million credentials leaked from a food delivery app breach. They test all 2 million against a fintech's login API overnight. 8,000 accounts share the same password and are successfully taken over before anyone notices.
Scenario 2
Stolen credentials are used to log into a SaaS platform, access customer data stored in those accounts, and scrape it for competitive intelligence — all appearing as normal user activity.
Scenario 3
On a wallet app, 300 successful stuffing logins lead to immediate withdrawal requests to mule accounts. The window from first login to fund transfer is under 4 minutes per account.
Anomira detects credential stuffing through a combination of signals: high volume of login attempts from a single IP or a distributed network of IPs, an unusually high ratio of failed-to-successful logins, and requests that follow no human-pacing pattern (all identical intervals, no browsing between attempts).
See this attack in your live API traffic
Anomira detects credential stuffing automatically — no configuration needed.