Unit IV — Authentication: Passwords, Hashes and BeyondLesson 2 of 8

Turning Point Training Institute

How Passwords Are Stolen: From Phishing to Credential Stuffing

12 min readBeginner

Where you are: Unit IV — Authentication: Passwords, Hashes and Beyond · Lesson 4.2 · This lesson follows Chapter 10 of Dr. Al-Doori's Cyber Security Essentials.

What you'll be able to do

Match each way passwords are stolen to the defense that actually stops it, and explain why reuse is the biggest single risk.

Name the main ways criminals obtain passwords today, including two that matter more than ever: credential stuffing and infostealer malware.
Choose the defense that genuinely works against each one, and recognise when a stronger password makes no difference at all.
Explain why one reused password can turn a single breach into many.

Three ways a password escapes

Chapter 10 of Dr. Al-Doori's book walks through ten common threats to passwords and makes a point that is easy to miss: a strong password defeats some of them completely and is powerless against others. That insight is the key to this lesson. It helps to group the threats into three families, because each family needs a different kind of defense.

1. You are tricked into handing it over

Disclosure: telling someone your password, or leaving it somewhere others can find it. Once shared, you no longer control it.
Social engineering: someone pretends to be IT support, your bank or a colleague and simply asks. Lesson 3.1 covers the psychology; the rule is never to share a password, whoever asks.
Phishing: a message lures you to a fake login page. Today these pages often collect more than your password. The US Cybersecurity and Infrastructure Security Agency (CISA) describes people typing both their password and a six-digit code from their authenticator app into a fake portal, which the criminal then uses at once on the real site.

What stops it: never sharing; reaching sign-in pages yourself rather than through links in messages (Lessons 2.3 and 3.2); a password manager whose autofill is tied to the real site (Lesson 4.4); and, strongest of all, phishing-resistant sign-in such as passkeys (Lesson 4.6). A stronger password does nothing here: you would hand over the strong one just as easily.

2. Software or a network captures it

Keyloggers and infostealers: the book describes keyloggers, which record what you type. Their modern relative is infostealer malware, which harvests the passwords saved on an infected device together with session cookies, the small files that keep you signed in to a site. Huge collections of these "stealer logs" now circulate, and they are a major source of the data loaded into the breach-checking service Have I Been Pwned. What stops it: keeping devices updated, installing software only from trusted sources, and adding MFA or passkeys so a stolen password alone is not enough. Password strength does not help.
Wireless sniffing: someone nearby captures what travels over a Wi-Fi network. For passwords this risk has shrunk dramatically: Google reports that about 95–99% of page loads in Chrome have used encrypted HTTPS connections since around 2020, so what you type travels encrypted. The remaining dangers are fake hotspots and login pages, sites without HTTPS, and clicking through certificate warnings; Lessons 5.7 and 5.9 cover them.

3. It is guessed or cracked

Brute-force and dictionary guessing: a program tries possible passwords, starting with the most likely. Modern guessing lists are built from billions of real passwords exposed in past breaches. What stops it: a long, random password (Lesson 4.3) on your side, and on the service's side, limits on failed attempts (NIST SP 800-63B-4 caps consecutive failures at 100 per account), blocking common and breached passwords, and MFA. CAPTCHA puzzles help a little, but OWASP warns they are not perfect and are often defeated by tools and services; treat them as a speed bump.
Stolen password files: if a site stores passwords in plain text, a breach exposes them directly; if it stores hashes, attackers guess and compare offline (Lesson 4.1). What stops it: on your side, a long, random password that is not on any list, and never reusing it.
Security questions: "secret" answers such as a first pet's name are often easier to discover than the password itself. What stops it: random answers stored in your password manager (Lesson 4.7).

Credential stuffing: why reuse is the biggest risk

One major threat today is not among the book's ten: credential stuffing. OWASP defines it as attackers taking username and password pairs leaked from one site and automatically trying them on many others. A related technique, password spraying, tries one common password against a large number of accounts.

The scale is enormous. In November 2025, Troy Hunt, who runs Have I Been Pwned, reported adding a single credential-stuffing collection containing about 2 billion email addresses and 1.3 billion unique passwords, of which about 625 million had never been seen in his service before. Verizon's 2025 Data Breach Investigations Report found that credential abuse was the initial way in for about 22% of the breaches it analysed.

This is why reuse is the biggest single password risk for most people. If you use the same password on a gaming forum, your email and your bank, then your bank account is only as safe as the forum's password storage. Strength does not save you: a 20-character password reused everywhere is exposed the moment any one site holding it is breached, and the attacker simply types it in. OWASP calls multi-factor authentication by far the best defense services have against stuffing. Your own defense is simpler still: a different password for every account, which a password manager makes effortless.

Activity: match the attack to the defense

Match each attack (1–6) to the defense that best stops it (A–F). Check your answers in the note after the Knowledge Check.

Attacks

1. A fake "your account is locked" page asks for your password and the code from your app.
2. Malware on a laptop copies its saved passwords and sign-in cookies.
3. A criminal tries email and password pairs leaked from a forum breach against your bank account.
4. A caller "from IT" asks for your password so they can fix your mailbox.
5. A stolen file of unsalted hashes is run against a list of common passwords.
6. Someone looks up your first pet's name on social media to reset your account.

Defenses

A. A unique password for every account
B. Updates and software only from trusted sources, plus MFA or passkeys
C. A passkey, or signing in only through addresses you type or have saved
D. A long, random password that appears on no guessing list
E. Hang up and contact IT through a number you already know
F. A random security-question answer stored in your password manager

Real-World Example

In December 2009, attackers breached a service called RockYou. About 32 million user accounts were exposed, and the passwords had been stored in plain text. The security firm Imperva analysed the leaked list in January 2010: the three most common passwords were 123456, 12345 and 123456789.

The case teaches three lessons that still apply. First, you cannot control how a site stores your password, so assume any site can be breached. Second, real leaked passwords like these are the raw material of modern guessing lists. Third, every RockYou user who reused that password elsewhere had a problem far beyond RockYou.

From the Book to 2026

What the book teaches. Chapter 10 lists ten common threats: disclosure, social engineering, phishing, keylogging, wireless sniffing, brute force, dictionary attacks, unencrypted password files, known-hash matching and security questions. Its key takeaway is that a strong password helps only against the guessing-based threats, and that for the rest, awareness is your protection.

Why it made sense. The list still describes how passwords are lost, and the central insight, that strength and good handling are different things, is the foundation of this unit.

What has changed. Security guidance has evolved since the original text. Credential stuffing has become one of the most significant password threats, fuelled by billions of leaked pairs. Infostealer malware is the modern, large-scale successor to the keylogger. Widespread HTTPS has made sniffing passwords over Wi-Fi rare. Limits on login attempts, blocking of breached passwords and MFA now do more than CAPTCHAs to stop guessing. And technical controls now help with several threats that once relied on awareness alone: MFA blocks most attacks that use a stolen password, phishing-resistant sign-in protects against fake pages, unique passwords contain breaches, and domain-bound autofill can warn you of a look-alike site.

What to do now. Keep the awareness the book teaches, and add the controls: a unique password for every account, MFA or passkeys on important accounts, and updated devices.

What Would You Do?

A friend tells you: "I'm safe. I use one very strong 20-character password for everything, and I never click suspicious links."

What would you tell your friend? Decide, then check the note after the Knowledge Check.

Knowledge Check

Your friend uses one very strong password on every site. Which threat leaves them most exposed?

You sign in to your bank's website, which uses HTTPS, on a café's Wi-Fi. What is now the more realistic risk to watch for?

Infostealer malware copied the saved passwords and sign-in cookies from your laptop. Which response does most to limit the damage?

A fake portal captured both your password and the six-digit code from your authenticator app. Which sign-in method is designed to resist exactly this?

Answers explained

Activity: 1–C, 2–B, 3–A, 4–E, 5–D, 6–F. Notice that only one of the six (number 5) is solved by password strength. The others need uniqueness, verification habits, device hygiene or a better sign-in method.
Question 1 — b is right. Strength does not help when the password itself is leaked: one breach anywhere hands the attacker a password that works everywhere. a is not the issue, because a long random password resists guessing. c is unlikely, because HTTPS encrypts what you type. d is not right: CAPTCHAs only slow automated attempts and do nothing about a leaked password.
Question 2 — c is right. The realistic risks are being steered to a fake network or page, or clicking through a certificate warning. a and b describe classic eavesdropping, which HTTPS encryption now largely prevents. d is not right: the network carries your connection, it does not store your password.
Question 3 — d is right. The malware has to be dealt with first, otherwise new passwords can be stolen too; changing passwords, ending other sessions and adding MFA or passkeys then makes the stolen data far less useful. a does not help, because the passwords were stolen, not guessed. b does not remove the malware or invalidate stolen cookies. c does nothing about the stolen passwords.
Question 4 — a is right. A passkey is tied to the genuine site, so a look-alike page has nothing it can collect and replay (Lesson 4.6). b would be typed into the fake page just as easily. c is still a code a person can type into a fake page, and texts add SIM-swap risk (Lesson 4.5). d has nothing to do with signing in.
What Would You Do? Your friend is protected against guessing, but not against credential stuffing: if any site holding that password is breached, every account is open. They need a different password for each account, most easily from a password manager, and MFA or passkeys on important accounts.

Key Takeaways

A strong password stops guessing, but not phishing, malware, social engineering or reuse.
Credential stuffing turns one breach into many, which makes reuse the biggest single password risk for most people.
Infostealers steal saved passwords and sign-in cookies; updates, trusted software and MFA limit the damage.
HTTPS has made Wi-Fi sniffing of passwords rare; fake hotspots and fake pages remain.
Use a unique password for every account, and add MFA or passkeys where it matters most.

Sources

PreviousHow Logins Work: Hashing and Salting Passwords NextThe Few Passwords You Must Remember: Length and Randomness