Credential stuffing is an online password attack where an adversary takes username-password pairs stolen from one breach and uses automated tools to try them on other sites, betting that people reuse the same login everywhere.
Credential stuffing is a type of online password attack. Instead of guessing passwords from scratch, the attacker starts with real login pairs (usernames and passwords) that leaked from some earlier data breach. Then automated software fires those same pairs at a bunch of other websites and services.
Why does it work? Because people reuse passwords. If your email password leaked from one site, an attacker just plugs that same combo into your bank, your gaming account, your school portal, and so on. The attack lines up with [AP Cybersecurity 1.2.A], which covers using "stolen passwords" to log in, and you spot it through the same red flags as any online attack: lots of failed login attempts, logins at weird hours, and logins from unfamiliar devices (EK 1.2.A.2).
This term lives in Unit 1: Introduction to Security, specifically topic 1.2 Suspicious Website Logins. It supports [AP Cybersecurity 1.2.A] (identify signs of a password attack), [AP Cybersecurity 1.2.B] (how adversaries exploit weak authentication), and [AP Cybersecurity 1.2.C] (how to make authentication stronger). Credential stuffing is the cleanest example of why "unique" matters in the long, random, unique password rule. The defense against it, MFA, comes straight out of EK 1.2.C.3.
Keep studying AP Cybersecurity Unit 1
Visual cheatsheet
view galleryOnline password attack (Unit 1)
Credential stuffing IS a kind of online password attack. The attacker hits a live login page and the system can see the failed attempts, which is exactly the signal EK 1.2.A.2 tells you to watch for.
Dictionary attack (Unit 1)
Both are automated guessing, but a dictionary attack builds a list from personal info or common words (EK 1.2.B.2). Credential stuffing skips the guessing and reuses passwords that are already confirmed real from a breach.
Multifactor authentication (MFA) (Unit 1)
MFA is the direct counter (EK 1.2.C.3). Even if an attacker has your correct stolen password, they still need a second factor like a one-time code, so a leaked password alone gets them nowhere.
Authentication log (Unit 1)
Stuffing leaves a trail. The log shows many failed logins in a short window and attempts from unknown devices, which is how a defender catches the attack in progress.
Expect this on multiple-choice questions about identifying password attacks. A stem might describe an account accessed from "a smartphone they have never owned" and ask which warning sign that is, or describe an attacker reusing stolen credentials across services. Your job is to match the scenario to the right attack type and name the correct defense (MFA, plus long, random, unique passwords). No released FRQ has used this term verbatim, but the underlying skill, spotting suspicious login signs and recommending stronger authentication, is squarely in scope for Unit 1.
A dictionary attack guesses passwords by trying a list of likely candidates (common words, a target's pet name, birthdate). Credential stuffing doesn't guess at all. It reuses real username-password pairs that already leaked from another breach, betting the victim recycled the same login.
Credential stuffing is an online password attack that reuses stolen username-password pairs across many sites, exploiting the fact that people repeat passwords.
It only works because of password reuse, which is why the 'unique' part of long, random, unique passwords (EK 1.2.C.1) is the core defense.
The warning signs are the same as any online attack: many failed logins fast, logins at unusual times, and logins from unknown devices (EK 1.2.A.2).
MFA stops credential stuffing cold because a correct stolen password still fails without the second factor (EK 1.2.C.3).
Unlike a dictionary attack, credential stuffing doesn't guess passwords, it reuses ones already confirmed real from a breach.
It's an online password attack where an adversary takes username-password pairs stolen from one breach and uses automated tools to try them on other websites, counting on people to reuse the same login. It fits under topic 1.2 and learning objective [AP Cybersecurity 1.2.A].
No. A dictionary attack guesses passwords from a list of likely words or personal details (EK 1.2.B.2). Credential stuffing doesn't guess, it reuses real passwords already stolen in a breach, so the only thing being tested is whether you reused that login somewhere else.
Yes. Even with your correct stolen password, the attacker still needs a second factor like a one-time code (EK 1.2.C.3), so a leaked password by itself isn't enough to get in.
Watch for the online-attack signs in EK 1.2.A.2: lots of failed login attempts in a short window, logins at unusual times, and logins from unknown devices. An authentication log is where you'd see this pattern.
It's the clearest real-world reason the CED stresses unique passwords and MFA. A question may describe a stolen-credential scenario and ask you to name the attack or pick the strongest defense, drawing on objectives [AP Cybersecurity 1.2.A] through [AP Cybersecurity 1.2.C].
Connect this key term to the AP exam workflow: review the course, practice questions, and check related study tools.