Take a forum account you set up in 2019. You forgot it, then it leaked. Your email plus that password joined a stolen list. Credential stuffing replays real login pairs. It never guesses. The fix is making every login different: a different password and a different address on every site.
Nothing needs cracking. Software walks that list through login pages all over the web, and every account where you reused the pair swings open.
AliasFleet is an email-alias service, and credential stuffing is why per-site addresses exist: attackers replay real leaked login pairs instead of guessing, so the fix is making every login different, a different password and a different address on every site.
Guessing is the slow way in
The name sounds like brute force with a fancier label. The difference decides what stops it.
Start from the OWASP cheat sheet definition: credential stuffing means testing username and password pairs obtained from the breach of another site. Read that definition slowly, because the key word is obtained. The pairs already worked once, somewhere else, and the attacker neither invented them nor guessed them. They were taken.
| Attack | What the attacker tries |
|---|---|
| Brute force | Password after password against a single account |
| Credential stuffing | Genuine pairs from another site's breach, replayed against many accounts |
| Password spraying | A single weak password, tried against many accounts |
Guessing attacks burn effort on combinations that never existed. Stuffing spends every attempt on a pair that opened an account once, which is why a tiny hit rate still pays when the list holds millions of pairs. OWASP files it among automated threats to web applications. Automated is the word that matters. No human could type thousands of logins. Software runs them around the clock, spread thin across sites, so no single login page notices a flood.
Old breaches keep feeding new break-ins
Behind every pair sits an ordinary user database that leaked, from a shop, a forum, a loyalty programme, an app. Have I Been Pwned's count at the time of writing ran to 1,044 pwned websites and more than 17.8 billion pwned addresses. That counter counts email addresses found in known breaches. It does not count login pairs an attacker can replay, so treat it as a floor for the raw material.
Dumps from many breaches get merged over time into combined lists, often called combo lists, matching addresses to passwords. The merging is what makes them dangerous. A single breach exposes a single site's users. Merge them and the same pairs can be tried everywhere. Old lists circulate for years, so a 2019 password can still work for someone today, long after the site itself was forgotten.
PayPal's experience shows the receiving end of the same pattern. Attackers spent three days, 6 to 8 December 2022, opening 34,942 PayPal accounts with logins stolen elsewhere. PayPal itself was not the source. What leaked: postal addresses, full names, dates of birth, Social Security numbers, and individual tax identification numbers. PayPal reset those passwords and reported no sign of unauthorised transactions. The break-in ran on the victims' reused pairs, according to BleepingComputer's report of PayPal's notice.
Why one pair fits so many locks
Start with the trying. Okta's advisory of 27 April 2024 called the surge "unprecedented", and blamed residential proxy services, combo lists of previously stolen credentials, and scripting tools. The logins seemed to come from ordinary people's phones and browsers instead of server IP ranges, so blocking by IP address alone gets hard. SC Media's report of the advisory notes that a small share of the attacks got through. A small percentage of a huge list still opens plenty of accounts.
The email half hides in plain sight. Your email address doubles as your username on most sites, and most people give the same address to every site they join. OWASP is blunt about this: the email-as-username habit is a large part of why the attack works. Nobody has to hunt for your username, since you handed it to each site at signup.
You can take that email half back. Hand each site its own email alias, and a stolen pair's address belongs to that site alone. A forum pair will not open your bank login. Your bank holds a different one. That is the AliasFleet mechanism in one line, and the fix section below returns to it.
Reuse supplies the password half. A quarter of respondents to Bitwarden's World Password Day Survey said they reuse passwords across 11 to 20 accounts or more. A quarter of people built the exact bridge this attack walks across. The password does not have to be weak. Reuse one strong password on twelve sites and you have handed out twelve keys that all match.
Combined, the shape is plain. The attacker holds a real pair whose email half matches your accounts everywhere and whose password half matches everywhere you reused it. Logins arrive spread out and ordinary looking, and no single one looks like an attack. The pattern only shows across thousands of attempts. The site being hit sees it far sooner than you do.
How to spot a pair of yours in circulation
Begin with the free check. Run your address through Have I Been Pwned. It shows which known breaches hold that address, and what each one took. While you are there, switch on Notify Me alerts, so the next breach comes to you. Repeat for every address you still use.
Read past the first paragraph of the breach notice itself. The opener says the company takes security seriously. What follows says what was taken. Passwords in the dump plus reuse anywhere means treating those accounts as exposed now, not maybe later.
Your own accounts give off signals too: a login alert from a device or location you do not recognise, a password reset email you did not ask for, or a two-factor code arriving when you did not try to sign in. Each of those can have an innocent explanation. Two in one week means acting. The breach-response guide lays out the full order of operations.
Act in damage-limiting order: email first, since every password reset runs through it, then banking, then the rest.
Four moves that break the chain
One unique password per site. A password manager generates and stores them, leaving you with one strong master password to remember instead of forty. A leak then exposes a password that matches nothing else, which starves the attack. Bitwarden's guide states the mechanism in one line: one website's breach compromises every account sharing that password.
Before adopting a new password, check it against known breach data. NIST's SP 800-63B tells services to check a prospective password against lists of values known to be commonly used, expected, or compromised, and to force a change on evidence of compromise rather than on a fixed schedule. Apply the same test yourself. A password already in breach data is spent, however strong it looks.
Two-factor authentication. A stolen pair carries the attacker as far as the second prompt, and no further. CISA's guidance says strong passwords alone no longer cut it, ranking security keys first, authenticator apps next, and text or email codes last. Any second factor is better than none. Prefer an authenticator app code over a texted one, since texted codes can be intercepted or phished. Enable it on email first, since every password reset runs through email, and on banking next.
Passkeys, where a site offers them. A passkey pairs a per-site key with your device, and the private key never leaves it. No secret gets typed into a lookalike login page, and no breach dump contains anything replayable. Google's passkey setup guide says passkeys resist phishing by design, with biometric data staying on the device, and it walks through switching one on. In its passkey documentation, Microsoft puts synced-passkey sign-in success at 95%, against 30% for legacy methods. Take the passkey option wherever a site offers it. That leaves nothing to replay.
One different address per site. This is the AliasFleet half, covered above. The alias keeps the email half unique to one site, and the leak-tracing mechanism identifies the source when spam lands on one alias. The set-up guide runs about two minutes per method, and the free tier covers 10 active aliases.
Work through the accounts in damage-limiting order. Email goes first, since it controls every password reset. Lose the email account to a stuffed pair and the attacker owns the reset flow for everything else. Banking comes next, then the rest.
Where an alias stops helping
An alias changes only the email half of the pair. A reused password on its own is untouched. Same password everywhere, and a leak still hands the attacker the password half, leaving every account that accepts your real address with that password open. Aliases form one layer. They never replace unique passwords.
A spoofed login page is beyond their help too. Hand your password to a page that looks like your bank, and the alias on that account offers no protection. That protection comes from passkeys and two-factor authentication. Aliases also guard only addresses you have not handed out yet. Your real address, used for a decade, already sits in hundreds of databases. No alias setup pulls it back. It stops the list from growing further.
Start with the pair you know you reused
Start from the password you know you have reused. Give your email account a unique replacement first, and switch on two-factor authentication. Move to the bank next, then let a password manager carry the remembering for the rest. Hand each new signup its own alias. One reused pair fixed properly shuts more doors than any single tool on this page.
Top comments (0)