What password attack uses a stolen password breach list?

Credential stuffing relies on obtaining real, previously validated credential pairs from publicly leaked or purchased breach lists and then replaying them against other services to exploit password reuse. This distinguishes it from guessing-based attacks because the credentials are known to have been correct at least once, dramatically increasing success rates against accounts that reuse passwords.

Pass-the-Hash captures NTLM hash values from memory or the SAM database and replays the hash directly for authentication, rather than using plaintext passwords from a breach list.

A dictionary attack generates guesses from a wordlist of common passwords and phrases rather than using actual stolen credential pairs from a confirmed breach.

A Man-in-the-Middle attack intercepts live communications between two parties and does not involve replaying or testing stolen password lists against accounts.