Credential Stuffing.
An automated attack that replays username-password pairs harvested from data breaches against unrelated sites, exploiting password reuse.
Credential stuffing volume against major SaaS targets runs in the millions of attempts per day. Most are filtered at the network layer (Cloudflare bot management, Akamai Bot Manager, DataDome). The residual hits the auth layer where breached-password detection and rate limiting take over. The single highest-leverage long-term defense is passkey adoption, the attack class doesn't apply to credentials that aren't reusable across sites.
Common questions
How is credential stuffing different from brute force?
Does MFA stop credential stuffing?
Can passkeys eliminate credential stuffing?