83 percent of credential stuffing campaigns target APIs

According to new research from Radware 83 percent of credential stuffing campaigns include explicit API-targeting techniques.

The report shows a shift in credential stuffing attacks, underscoring a fundamental transformation from volume-based attacks leveraging a series of repeated password attempts to more sophisticated, multi-stage infiltration techniques.

“To bypass traditional defenses, modern credential stuffing attacks are shifting away from traditional password-spraying techniques in favor of business logic manipulation, cross-platform device spoofing, and strategic API exploitation,” says Arik Atar, senior cyber threat intelligence researcher at Radware. “The message for defending organizations is clear. To match this new reality, they must move beyond credential-centric controls to adopt security strategies that validate entire user journeys, correlate cross-request behavior, and detect suspicious patterns in business logic flows.”

Other advanced attack techniques highlighted by the report include business logic attacks, with 94 percent of configurations implementing four or more business logic attack elements, and 54 percent demonstrating advanced orchestration, using 13 or more distinct techniques.

Multi-device spoofing is increasingly common too with 24 percent of attack scripts alternating between two device types during execution, and 71 percent employing cross-platform transitions, primarily between iOS and Windows.

The technology/SaaS sector has emerged as the primary target (27 percent), followed by financial services/government (16 percent), and the travel/airline (13 percent) sectors. There is a significant shift toward high-value AI tools (44 percent of all technology targets), potentially exploited by spammers who engage in account cracking to create large-scale phishing content. In addition, corporate tools (30 percent), including Microsoft 365, OneDrive, and Outlook, are likely targets for ransomware groups seeking initial access to organizational systems.

You can find out more in the full report, available from the Radware site.

Image credit: [email protected]/depositphotos.com