Credential Stuffing

Attackers use credential stuffing — testing stolen username-password pairs from previous breaches across many websites.