Credential stuffing is one of the most pervasive and underestimated automated threats in Australian cybersecurity today. Unlike brute-force attacks that guess passwords, credential stuffing uses verified credentials: real username and password combinations harvested from prior data breaches. Attackers feed these pairs into automated bots, trying them across hundreds of services simultaneously and banking on one simple truth: people reuse passwords.
For Australian organisations, the risk is acute. Local businesses handle significant volumes of customer accounts, and the country's notifiable data breach reporting obligations mean that a successful stuffing attack that exposes personal information triggers formal regulatory consequences. Understanding how these attacks are structured is the first step to defending against them effectively.
How credential stuffing actually works
The attack lifecycle starts with a breach somewhere else. When a third-party service is compromised, the stolen credential database is eventually leaked or sold on dark web forums. Attackers then purchase or download these lists, which can contain hundreds of millions of valid email and password combinations from years of accumulated breaches.
From there, the process is largely automated. Attackers use tools like Sentry MBA, OpenBullet, and various custom scripts to try credentials against target login pages at scale. The bots are typically configured to rotate IP addresses, use headless browsers to mimic real users, and throttle request rates to avoid triggering obvious rate-limiting controls. A successful login is flagged, and the compromised account is either used directly (for fraud, data theft, or account takeover) or sold in bulk on secondary markets.
What makes credential stuffing particularly dangerous is its efficiency. A credential list with a one percent success rate sounds low, but applied against ten million records, that yields one hundred thousand compromised accounts. The cost to the attacker is minimal; the cost to victims and target organisations is severe.
Why Australian organisations are targeted
Australia's relatively high internet penetration, large e-commerce sector, and concentration of financial services make it an attractive target for credential stuffing campaigns. Attackers do not necessarily care about compromising a specific Australian company; they run their tools against any service with valuable account data and collect whatever yields results.
The local context adds another layer of complexity. Many Australian SMEs run their own customer-facing platforms without the WAF (web application firewall) and bot management tooling that larger enterprises have. Their login pages are often easier targets than those of hardened global platforms, and their security monitoring may not catch the slow, distributed login attempts that typify credential stuffing campaigns.
It is also worth noting that Australian breaches feed the global credential ecosystem. When local organisations are compromised, their data circulates internationally and is folded back into future stuffing campaigns targeting other Australian services. This cyclical dynamic is part of why Australia's Notifiable Data Breaches scheme is so important: timely disclosure allows affected users to change passwords before their credentials are weaponised.
The limits of MFA as a defence
Multi-factor authentication (MFA) is the most commonly recommended control against credential stuffing, and for good reason. An attacker who successfully validates a username and password pair still cannot complete login without the second factor. For organisations that have deployed MFA across all customer-facing services, credential stuffing is largely neutralised at the account takeover stage.
The problem is that MFA deployment is rarely universal. Customer-facing applications often have lower MFA adoption than internal tools, partly because organisations worry about friction reducing conversion rates or driving users away. Legacy platforms may not support modern authenticator apps. And some MFA implementations are themselves vulnerable: as covered in our analysis of why MFA alone is not enough, push-notification fatigue attacks and adversary-in-the-middle phishing can bypass even well-implemented second factors.
The practical takeaway is that MFA is necessary but not sufficient. Organisations need layered defences that reduce attacker success rates even before authentication is reached.
Technical controls that actually reduce stuffing success rates
Beyond MFA, a layered defensive posture against credential stuffing includes several complementary controls.
- Bot management and device fingerprinting: Purpose-built bot management platforms (from vendors such as Cloudflare, Akamai, and Imperva) identify and block automated login attempts based on behavioural signals: request cadence, browser characteristics, JavaScript execution patterns, and IP reputation. These signals are invisible to legitimate users but highly diagnostic for bot traffic.
- Rate limiting on login endpoints: Simple rate limiting by IP address is easily bypassed through IP rotation, but more sophisticated controls that rate-limit by username, device fingerprint, or ASN can slow stuffing campaigns significantly. Combining these signals increases attacker cost without frustrating genuine users.
- CAPTCHA with adaptive thresholds: Deploying CAPTCHA only when risk signals are elevated, rather than universally, reduces user friction while still blocking bots in suspicious sessions.
- Credential breach monitoring: Services such as Have I Been Pwned and enterprise equivalents provide feeds of known-compromised credentials. Checking login attempts against these feeds allows organisations to force password resets for users whose credentials appear in breach databases before attackers exploit them.
- Anomaly detection on login behaviour: Monitoring for unusual login patterns, such as a spike in failed attempts from a geographically diverse set of IPs, or a surge in logins against a specific username, allows security teams to detect campaigns in progress and respond quickly.
What to do when a campaign is detected
Detection and response to an active credential stuffing campaign requires a different playbook than many other incident types. The attack is not a single intrusion event but a distributed, ongoing campaign. Blocking individual IPs is generally futile; the attacker has many more available.
The immediate priority is to confirm the scope. Which accounts have been successfully authenticated from suspicious sessions? What data or functions did those sessions access? Correlating anomalous login activity with downstream events (password changes, address changes, transaction initiation) is essential for identifying affected users.
Affected accounts should be locked and users notified promptly. If personal information was accessed or exfiltrated, Australian organisations are likely obligated to assess whether a notifiable breach has occurred under the Privacy Act. The 72-hour window for internal triage and assessment is tight, so having a pre-built response playbook matters considerably.
On the technical side, enabling stricter bot controls and temporarily raising CAPTCHA thresholds can reduce the rate of ongoing account compromises while the campaign is active. Coordinating with your WAF or CDN provider to apply IP reputation blocklists in real time is also a practical step. Longer term, the campaign is an argument for accelerating MFA rollout and deploying breach credential monitoring if those controls were not already in place.
Reducing organisational exposure over time
Credential stuffing is a systemic problem, not a single attack to patch and forget. The underlying driver is password reuse, and that behaviour will persist as long as organisations allow it. The most durable reduction in exposure comes from reducing reliance on passwords altogether: pushing users toward passkeys, hardware tokens, or strong authenticator apps removes the vulnerability that credential stuffing exploits at its root.
Passwordless authentication is no longer a fringe option. Modern platforms support FIDO2 and WebAuthn standards broadly, and several Australian financial services providers have already deployed passkey login for retail customers. For organisations that cannot move to passwordless in the near term, periodic forced password resets triggered by breach intelligence feeds provide a meaningful middle ground.
Security awareness also plays a role, though it should not be the primary control. Encouraging users to use unique passwords for every service, and providing access to a reputable password manager, reduces the credential overlap that makes stuffing campaigns effective. This is especially relevant for B2B platforms where compromised employee accounts at one organisation can cascade into attacks on partner systems.
Credential stuffing will remain a persistent threat as long as large breach databases continue to circulate and password reuse remains common. Australian IT teams that layer bot management, MFA, breach monitoring, and anomaly detection are in a far stronger position than those relying on any single control. The goal is to make the attack expensive enough that adversaries move on to softer targets.