← Enciclopedia de estafas

Toma de cuentas por credential stuffing: cómo funciona, señales y qué hacer

Identity theft · médio

Criminals gather lists of emails and passwords from old breaches or harvested by infostealer malware and automatically test those combinations, using bots, across thousands of sites. Wherever the password was reused, they get in.

Once inside, they change recovery email and phone, buy with saved cards, redeem points, sell the account or use the email to reset passwords on other services.

The ITRC annual report counted 28 credential stuffing attacks among US data compromises in 2025.

Sinais / Signs

• Login alerts from an unknown location or device
• Recovery email or phone changed without your request
• Orders or point redemptions you did not make
• Receiving several password-reset codes
• Your email shows up in breach-alert services

Prevenção / Prevention

• Use a unique password for every service, with a password manager
• Turn on MFA, preferably an authenticator app or passkey
• Secure your main email first, since it resets every other account
• Remove saved cards from rarely used sites
• Companies: rate-limit logins, detect bots and offer passkeys

O que fazer / What to do

• Reset the password and sign out all active sessions
• Restore recovery email and phone and enable MFA
• Change that password on every other service where it was used
• Dispute purchases and notify the affected service
• If your data was used to open accounts, use IdentityTheft.gov (US)

FAQ

My password is strong. Am I still at risk?

Yes, if it was reused and leaked from any service. Strength does not protect against reuse.

How is this different from phishing?

In phishing, the victim hands over the password. In credential stuffing, it already leaked and is tested automatically.

Radar

1. 2026-06-05 — Dashlane: ataque de fuerza bruta obtiene bóvedas cifradas de clientes. Los atacantes usaron fuerza bruta contra cuentas del gestor de contraseñas; no se informó cuántas bóvedas. Fuente: Help Net Security
2. 2025-06-01 — Compilación de 30 bases de infostealers reúne unos 16.000 millones de credenciales · ~16 bi de logins. El conjunto agrega credenciales robadas por malware infostealer; la cifra proviene de una compilación secundaria. Fuente: VoxBooster (compilação secundária)

• Passkeys, MFA and the end of passwords: what stops account takeover

FTC - IdentityTheft.gov · ITRC 2025 Annual Data Breach Report (PDF) · CERT.br · ANPD