Executive Summary
Okta Threat Intelligence is monitoring a thriving ecosystem of profit-motivated actors that use credential stuffing to compromise user accounts at online service providers.
This cybercrime ecosystem has largely consolidated around a standardized set of capabilities: open source account checking tools (e.g. OpenBullet, SilverBullet), configuration (“config”) files loaded into those tools to customize attacks to a targeted service, (“combo”) lists of previously breached credentials to check against the targeted service, and proxy networks that distribute an attack across scores of residential IPs for defense evasion.
We continue to observe the impact of artificial intelligence on this mature market: specifically the ability for an attacker to dynamically develop new config files for any given target. While the AI tools we have observed do not change the fundamental weaknesses that make credential stuffing attacks effective (password re-use), they scale the reconnaissance and resource acquisition phases of an attack significantly. We anticipate a higher frequency of attacks against a broader number of online service providers.
In this environment, the only durable method of prevention in CIAM (customer identity) organization is to transition user accounts to passkeys.
Background
In credential stuffing attacks, threat actors acquire lists of username and password pairs stolen in unrelated incidents and programmatically cycle through each to check if the same credentials work against a targeted service.
Compromised accounts are then resold in underground forums. In a CIAM context, the value of a compromised account is often measured by the “stored value” it can access - be it a gift card balance, loyalty points or access to exclusive rewards.
These attacks are costly to service providers in terms of responding to incidents and dealing with account holders seeking restitution after their credit or reward points have been stolen.
This type of attack is best mitigated by requiring a phishing-resistant factor, such as a passkey, as an alternative or additional form of user verification during the sign-in process.
Targeted industries
Over the last year, Okta Threat Intelligence has observed a number of industries targeted by profit-motivated attackers using credential stuffing, with the most targeted being those with access to stored value:
- Retail Trade
Retail Trade
- Food Manufacturing / Beverage
Food Manufacturing / Beverage
- Transportation and Warehousing
Transportation and Warehousing
- Information technology
Information technology
- Arts, Entertainment and Recreation
Arts, Entertainment and Recreation
To better understand these attacks, Okta Threat Intelligence obtained and studied 418 configuration files posted in underground forums that are designed to facilitate credential stuffing attacks.
Configuration files are customized instructions for how a credential stuffing attack tool can most efficiently test user credentials against a targeted service provider’s infrastructure. A detailed analysis on how these files are used is provided below.
The following chart shows the top 10 most targeted service categories included in the configuration files we obtained.
Threat analysis
Attacker tooling
There is a mature ecosystem of tools and resources used in credential stuffing attacks.
The dominant account checking tool is OpenBullet 2, an open-source application purpose-built for automating high volumes of authentication requests and is widely abused for credential stuffing. OpenBullet offers web clients for Linux, MacOS and Windows. Web clients can be deployed to virtual private servers and managed by a remote attacker using their browser.
Another dominant tool is SilverBullet, which is a fork of the first version of OpenBullet and optimized to defeat bot detection controls.
All support the following features:
- Proxies. In order to bypass IP-based security controls, OpenBullet 2 supports HTTP and SOCKS proxies. OpenBullet 2 supports rotating proxies, which allows attackers to distribute their authentication attempts across a large pool of IP addresses.
Proxies. In order to bypass IP-based security controls, OpenBullet 2 supports HTTP and SOCKS proxies. OpenBullet 2 supports rotating proxies, which allows attackers to distribute their authentication attempts across a large pool of IP addresses.
- Configs. Short for “configurations,” these files are effectively scripts that direct the tool to send a sequence of requests in a specified format to specified authentication-related endpoints, and to parse and process the results according to the author’s requirements.
Configs. Short for “configurations,” these files are effectively scripts that direct the tool to send a sequence of requests in a specified format to specified authentication-related endpoints, and to parse and process the results according to the author’s requirements.
- Word lists. Credential stuffing relies on lists of username and password combinations, often referred to as “combo” or combination lists. OpenBullet and SilverBullet sequentially enter the credentials sourced from these files during attacks.
Word lists. Credential stuffing relies on lists of username and password combinations, often referred to as “combo” or combination lists. OpenBullet and SilverBullet sequentially enter the credentials sourced from these files during attacks.
- Hits. During a credential stuffing run, the results are written to a SQLite database.
Hits. During a credential stuffing run, the results are written to a SQLite database.
Configs
Configuration files are key to a successful attack. These files are based on reconnaissance of a target’s authentication systems by skilled attackers. A file defines the endpoints, the sequence in which authentication requests should occur and the parsing logic for the results. The files, which usually end in .opk (OpenBullet) or .svb (SilverBullet) must be up-to-date to match the latest configuration of the target. These scripts are written in the LoliCode scripting language in OpenBullet 2 and LoliScript scripting language in OpenBullet and SilverBullet.
Some configuration files are advertised as “full capture,” meaning that after a successful authentication, the script retrieves account data such as personally identifiable information, profile data, order histories and stored payment information.
Creating configuration files is its own business line in the credential stuffing economy. These files are sold on underground forums, websites and messaging platforms. Prices advertised by one configuration vendor range from US$5.99 to $59.99, with the average price around $22.
The files are often given away for free as teasers for paid offerings or paid subscription services. Some vendors offer monthly or lifetime subscriptions that allow access to private repositories of configurations. Configuration file coders will also develop bespoke configurations based on customer requests.
The intellectual property of configuration files is considered valuable enough that OpenBullet 2 has a feature to run a configuration but hide its code from whomever is running the client.
Okta Threat Intelligence has observed the use of Artificial intelligence (AI) to write working configurations. Version 2.0 of the OpenBullet 2 web client, released in June 2026, now includes an MCP server out of the box that allows AI coding agents to interact with OpenBullet 2. The MCP server provides pre-written prompts for developing configuration files and documentation about LoliCode syntax for agents.
This allows users to create configuration files that target specific online service providers using natural-language commands. Given the extensive online documentation about these tools that agents can draw from, and the ability of agents to rapidly assess and reverse engineer the sign-in flow of a service provider, this is highly likely to result in a higher frequency of attacks against a broader range of targets.
Combo lists
Combo lists are another business line in the credential stuffing ecosystems. Combo lists are typically plain text files with long lists of credential pairs in formats such as URL:username:password or username:password. Some lists include labels describing what industry, vertical or geography the credential pairs were sourced from. The credentials in these lists are sourced from data breaches, information-stealing malware infections and phishing campaigns. Once collected, the credentials are usually de-duplicated and merged from their original sources into a single combo list.
Free combo lists are plentiful, and like configuration files, used as teasers for paid offerings. But giveaways have diminishing value, as user account passwords tend to be reset once knowledge of a breach is public or an account is subject to repeated attacks. New combo lists are constantly advertised in underground forums, with labels such as “HQ” (high quality), “UHQ” (ultra high quality), “Fresh” (newly sourced), “Private” (not widely circulated), “Valid” (still working) along with the number of records available.
Residential proxies
Residential proxies are critical infrastructure for credential stuffing attacks. IP-based security controls can easily slow down or stop an attack by analyzing an IP’s reputation or using real-time metrics, such as a high velocity of login attempts. Abusive IPs can be challenged with a CAPTCHA - to inhibit the use of automation - or blocked prior to authentication.
The tools used in credential stuffing support an ability to rotate login attempts through proxy servers. Residential proxy services allow attackers to thinly spread authentication attempts across a large pool of IPv4 and IPv6 addresses that are also used for legitimate traffic. Residential proxies often use IPs that have no prior history of abuse. This undermines the effectiveness of IP-reputation blocklists that anti-fraud systems rely on.
Attackers may use an IP only a few times before rotating to another one. Okta Threat Intelligence recently observed an attack in which over 800,000 residential IP addresses were used over a course of six hours, with the median IP making only twenty attempts before being rotated out entirely.
Attackers can pick exit nodes by country, city or even ISP, allowing login attempts to appear to originate from a location consistent with the targeted account. This attempts to subvert geolocation-based risk checks and subsequently evade the risk-based application of CAPTCHAs and per-IP rate-limiting.
Conclusion
The tools used to conduct credential stuffing are well established, and AI is likely to increase the speed at which configurations and tooling are developed. Threat actors can already draw on readily available infrastructure resources with which to make abusive login attempts appear to be legitimate ones. This encompasses varying user agent strings, varying TLS client fingerprints and employing IPv4 and IPv6 residential proxy networks.
Configuration files required for a specific credential stuffing attack can be generated with AI coding agents. Less skilled threat actors are therefore likely able to create configurations without relying on vendors that specialize in this underground product. Organizations can monitor for configuration files that target their organizations to see the endpoints targeted. While some configurations are released publicly on messaging platforms and underground forums, the newest and most effective ones are likely sold privately. Free configurations are likely used by multiple threat actors, which can prompt targeted organizations to modify web application firewall (WAF) rules to render the configuration ineffective.
Attackers look for authentication paths that fall outside whatever security controls an organization has deployed, and AI coding agents are likely accelerating resonance, weaponization and execution.
Recommendations
- Transition away from passwords to passkeys as the primary factor of authentication for users. Threat actors cannot steal passkeys with malware and replay them against authentication systems. This has a double benefit: Passkeys are a phishing-resistant factor and will also stop credential stuffing.
- Stream logs to a SIEM or data warehouse for detection and offline analysis.
- Verify good security posture for Okta Customer Identity organizations and Auth0 tenants. Auth0 customers should run CheckMate for Auth0 and implement its recommendations.
- Create detections, where applicable. Auth0 customers can refer to the open source auth0-customer-detections repository.
- Auth0 and Okta Customer Identity offer breached password protections, which detect credential reuse and trigger an action, such as blocking new signups, stopping logins with the credentials or sending email notifications warning of a login attempt.
ITRA-260810-01.0 - Credential stuffing actors abuse overlooked paths to access
MITRE ATT&CK
ATT&CK technique
Tactic
Control
T1110.004 Brute Force: Credential Stuffing
Credential Access
- Move away from passwords as a sole or primary factor. Passkeys, passwordless and other strong factors remove the value of a confirmed password to an attacker.
Move away from passwords as a sole or primary factor. Passkeys, passwordless and other strong factors remove the value of a confirmed password to an attacker.
- Enable Breached Password Detection and Credential Guard and enforce it by locking user accounts that attempt to log in using known breached credentials.
Enable Breached Password Detection and Credential Guard and enforce it by locking user accounts that attempt to log in using known breached credentials.
T1595.002 Active Scanning: Vulnerability Scanning
Reconnaissance
- Audit tenant configuration for legacy authentication paths that are not in active use.
Audit tenant configuration for legacy authentication paths that are not in active use.
- Disable Cross-Origin Authentication unless required. If required, make a plan to migrate to Universal Login.
Disable Cross-Origin Authentication unless required. If required, make a plan to migrate to Universal Login.
- Disable the Resource Owner Password Grant on any application without a current requirement for it, and restrict it to known first-party clients where it is required.
Disable the Resource Owner Password Grant on any application without a current requirement for it, and restrict it to known first-party clients where it is required.
- Run on a recurring basis. Reconnaissance activity recurs against tenants over time, and configuration should be re-audited on the same cadence.
Run on a recurring basis. Reconnaissance activity recurs against tenants over time, and configuration should be re-audited on the same cadence.
T1665 Hide Infrastructure
Defense Evasion
- Do not rely on IP- or ASN-based blocking as a primary control given the use of residential proxy infrastructure; treat it as a supplementary measure.
Do not rely on IP- or ASN-based blocking as a primary control given the use of residential proxy infrastructure; treat it as a supplementary measure.
- Close IPv6 coverage gaps in existing block rules. Rules written for IPv4 ranges only will not match IPv6 attack traffic.
Close IPv6 coverage gaps in existing block rules. Rules written for IPv4 ranges only will not match IPv6 attack traffic.
- Enforce enhanced dynamic zones on Okta Customer Identity organizations.
Enforce enhanced dynamic zones on Okta Customer Identity organizations.
Disclaimer
These materials are for general informational purposes only and do not constitute legal, privacy, security, compliance, or business advice. The content may not reflect the most current security, legal and/or privacy developments. You are solely responsible for obtaining advice from your own legal and/or professional advisor and should not rely on these materials for compliance, implementation, or purchasing decisions. Okta makes no representations or warranties regarding this content and is not liable for any loss or damages resulting from your implementation of these recommendations. Information on Okta’s contractual assurances to its customers may be found at okta.com/agreements.
