# Protect Against Credential Stuffing and Account Takeovers

## Description

Credential stuffing occurs when attackers **use stolen usernames and passwords**—often from unrelated data breaches—to gain unauthorized access to accounts. In Web3, this typically targets **project admin accounts**, including email, hosting, cloud services, and social media. Once access is obtained, attackers can manipulate websites, post malicious links, or steal funds.

This attack exploits **password reuse and weak security practices**, making it a low-effort but high-reward method for attackers.

## Why It’s Common in Web3

* **Password Reuse**: Team members may reuse passwords across multiple platforms, increasing exposure when any site is breached.
* **Weak Security Practices**: Lack of hardware security keys, poor password management, and minimal account monitoring make credential stuffing easier.
* **High Impact**: Admin accounts provide access to sensitive project infrastructure, making them a prime target.

## Impact

* **Website Compromise**: Attackers can modify project websites to redirect users to phishing or scam pages.
* **Financial Loss**: Access to wallets, treasury systems, or token sales can result in direct theft.
* **Community Trust Damage**: Unauthorized posts or malicious updates erode confidence in the project.
* **Operational Disruption**: Teams must spend critical time restoring compromised accounts and mitigating damage.

## Real-World Examples

* **Web3 Project Website Takeovers**: Compromised admin email accounts have led to attackers altering official project websites, redirecting users to phishing or scam sites, and sometimes draining connected wallets.
* **Decentralized Exchange Admin Breaches**: In some cases, compromised cloud credentials allowed attackers to temporarily modify front-end content, tricking users into signing malicious transactions.

## Mitigation Strategies

### 1. Strong Authentication

* **Use Hardware Security Keys (FIDO2/WebAuthn)** for all critical accounts (email, cloud, social media, hosting).
* **Enable Multi-Factor Authentication (MFA)** wherever possible, avoiding SMS-based 2FA.

### 2. Password Hygiene

* **Unique, Complex Passwords** for every account.
* **Password Managers** to generate and securely store credentials.
* **Regular Rotation** of passwords for critical systems and services.

### 3. Monitoring and Alerts

* **Login Monitoring**: Enable alerts for suspicious logins or failed login attempts.
* **Audit Logs**: Regularly review admin account activity and changes to sensitive systems.
* **Third-Party Breach Monitoring**: Track compromised credentials using services like Have I Been Pwned.

### 4. Access Control

* **Least Privilege Principle**: Limit admin access to only the accounts and systems necessary.
* **Segregation of Duties**: Different team members handle separate critical systems to reduce risk of full takeover.
* **Immediate Offboarding**: Revoke access for departing team members promptly.

### 5. Incident Response

* **Account Lockdown**: Immediately secure or disable compromised accounts.
* **Password & Key Rotation**: Change passwords and rotate keys for all affected systems.
* **Community Communication**: Inform users of potential risks if website content or communications were altered.
* **Post-Mortem Analysis**: Determine the breach vector and prevent future recurrence.

## Summary

Credential stuffing and account takeovers are **high-risk attacks for Web3 projects**, exploiting reused or weak credentials to compromise admin accounts. By implementing **hardware-backed authentication, strong password practices, monitoring, and strict access controls**, projects can drastically reduce exposure and maintain both security and user trust.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.optimumsec.xyz/ongoing-operations/credential-stuffing.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.