Leakage of user ID and password information from websites and SaaS platforms has become a regular occurrence. Often, these incidents result in large sets of credentials being shared widely online.
Credential stuffing is the practice of using authentication credentials leaked from previously-breached websites to perform automated login attempts to other websites. This technique is based on the premise that some percentage of users use the same credentials for multiple sites.
Increasingly, this practice is being applied to APIs directly (not through the front-end - be that a web or mobile application). This enables attackers to automate the attack more easily, since - after all - APIs are created for ease of consumption.