Distinguish credential stuffing vs phishing.

Distinguish credential stuffing vs phishing.

• A. Credential stuffing uses breached username/password combos on multiple sites; phishing tricks users to reveal credentials.
• B. Credential stuffing involves phishing emails; phishing uses credential stuffing across sites.
• C. Phishing relies on using brute force against accounts; credential stuffing uses social engineering.
• D. Phishing is always offline; credential stuffing is always online.

Answer: (A)

Credential stuffing relies on using stolen username/password pairs from breaches and trying them across many websites to gain access. It works because lots of people reuse the same credentials, so a valid pair from one site can unlock accounts on other sites when automated tools attempt to log in everywhere the pair might apply. The attacker isn’t primarily tricking the user to reveal information; they’re exploiting reused credentials and automation to break in. Phishing, on the other hand, is a social-engineering tactic that aims to get the user to hand over credentials themselves—often through fake emails or fake login pages that look legitimate. The attacker relies on manipulating the user, not on testing known credential pairs across sites. The other options mix up these methods: phishing is not about using credential stuffing across sites, and credential stuffing isn’t primarily about phishing or social engineering. It’s also not accurate to say phishing is always offline or that credential stuffing is always online in a way that distinguishes them; both are typically online, with credential stuffing being an automated, credentials-based intrusion method and phishing being a user-directed deception tactic.

Credential stuffing relies on using stolen username/password pairs from breaches and trying them across many websites to gain access. It works because lots of people reuse the same credentials, so a valid pair from one site can unlock accounts on other sites when automated tools attempt to log in everywhere the pair might apply. The attacker isn’t primarily tricking the user to reveal information; they’re exploiting reused credentials and automation to break in.

Phishing, on the other hand, is a social-engineering tactic that aims to get the user to hand over credentials themselves—often through fake emails or fake login pages that look legitimate. The attacker relies on manipulating the user, not on testing known credential pairs across sites.

The other options mix up these methods: phishing is not about using credential stuffing across sites, and credential stuffing isn’t primarily about phishing or social engineering. It’s also not accurate to say phishing is always offline or that credential stuffing is always online in a way that distinguishes them; both are typically online, with credential stuffing being an automated, credentials-based intrusion method and phishing being a user-directed deception tactic.