Attack

Credential stuffing

Trying leaked or common passwords against many accounts until some work.

Because people reuse passwords, credentials leaked from one site unlock accounts elsewhere. Password spraying tries a few common passwords against many accounts to avoid lockouts. MFA and breached-password checks stop most of it.