The Great Credential Caper: How to Perform and then Defend Against the (Nearly Impossible) to Defend

The Great Credential Caper: How to Perform and then Defend Against the (Nearly Impossible) to Defend

Speakers: Christo Roberts, Principal Product Manager, Cloudflare; Dan Hollinger, Product Leader

Conference: BSides SF

YouTube: https://www.youtube.com/watch?v=9L2h9CaN8hU

Overview

In "The Great Credential Caper," Christo Roberts and Dan Hollinger deliver a compelling and timely presentation on the escalating threat of credential stuffing attacks, particularly in an era increasingly dominated by agentic AI. The talk meticulously dissects how these attacks, which leverage previously breached usernames and passwords, have become significantly easier and more sophisticated for adversaries to execute. They highlight the alarming scale of the problem and demonstrate, through live and video demonstrations, how AI can effortlessly bypass traditional bot detection mechanisms and CAPTCHAs, fundamentally altering the landscape of online security.

This discussion is crucial for anyone involved in digital security, from individual users to enterprise defenders. Roberts and Hollinger not only illuminate the stark reality that credential stuffing is a pervasive and challenging threat, but also introduce a paradigm shift in defensive thinking. They argue that the focus must move beyond merely identifying automated traffic to discerning "authentic" user behavior, even when that behavior is mediated by an AI agent. The talk provides a comprehensive framework for understanding the evolving tactics of attackers and outlines a multi-layered defensive strategy essential for navigating this new, AI-augmented threat environment.

Background

▶ Watch: Defining credential stuffing and talk agenda (0:30)

Credential stuffing is a specific type of account takeover (ATO) attack, distinct from other methods like keylogging, info-stealers, shoulder surfing, or even specialized hardware like OMG cables. It relies on the simple, yet devastating, premise that many users reuse their usernames and passwords across multiple online services. When a single service suffers a data breach, the exposed credentials become a valuable commodity. Attackers then "stuff" these known username/password combinations into login forms of other, unrelated services, hoping to find a match. The sheer volume of leaked credentials available on the dark web and even the open internet makes this a highly effective attack vector.

The scale of this problem is staggering. Cloudflare, which observes approximately 20% of the world's internet traffic, reported that 41% of all login attempts in their analysis used a username or password previously exposed in a data breach. Furthermore, during a key retail period around Black Friday, an astonishing 95% of these compromised credential login attempts were made by automated attackers. This highlights that not only are users vulnerable due to password reuse, but sophisticated bots are actively and rapidly exploiting these vulnerabilities at an industrial scale. Attackers' motivations range from selling compromised accounts on the dark web to performing illicit purchases, scraping personally identifiable information (PII), or leveraging the compromised account to take over other related accounts, creating a cascading effect of breaches.

The accessibility of breached data further exacerbates the issue. Roberts demonstrated the ease with which these lists can be acquired, mentioning downloading a 10 GB file of plain-text usernames and passwords from a torrent site in minutes. Services like Troy Hunt's Have I Been Pwned database, while a vital resource for users to check their own exposure, also underscore the vastness of the problem, with 16 billion leaked passwords reported as of a recent count (though the speaker mistakenly referenced June 2025, implying a much earlier date for this data). This widespread availability, combined with the human tendency to reuse credentials, creates a fertile ground for credential stuffing attacks, making them a foundational threat in the current cybersecurity landscape.

Key Findings

▶ Watch: Automated bots exploit leaked credentials (3:40)

The central revelation of "The Great Credential Caper" is the transformative impact of agentic AI on the efficacy and ease of performing credential stuffing attacks. The speakers highlight several critical shifts:

1. AI Lowers the Bar for Attackers: Agentic AI tools, such as Claude Code, significantly reduce the technical skill required to launch sophisticated attacks. Simple, human-language prompts like "act like a human" or "solve these CAPTCHAs" are now sufficient for AI to generate complex evasion logic.
2. Evasion of Traditional Bot Detection: AI can autonomously adapt to bypass established bot detection mechanisms. By switching to tools like Playwright stealth mode, AI-driven bots can achieve high "human-like" scores (e.g., 89/100 on Cloudflare's bot scoring system), rendering traditional heuristic-based bot management less effective.
3. CAPTCHA Invalidation: The rise of AI has effectively neutralized CAPTCHAs as a reliable defense. Demonstrations showed AI effortlessly solving various CAPTCHA types, including Cloudflare Turnstile, hCaptcha, Google reCAPTCHA v2 (and v3), and even complex puzzle-based CAPTCHAs, often on the first attempt. This capability, combined with tools like Scrappling and OpenClaw, makes CAPTCHA-solving cheaper and easier than ever.
4. Shift from "Automated" to "Authentic": The core challenge for defenders has fundamentally changed. It's no longer sufficient to merely detect if traffic is automated; instead, the focus must shift to determining if traffic, even if automated, is authentic and performing expected, legitimate actions. This is due to the blurring lines between human-initiated automation (e.g., legitimate agents) and malicious AI.
5. The "Ralph Loop" and OpenClaw: The concept of the Ralph Loop (an AI self-correction mechanism where the tool learns and iterates based on output) combined with OpenClaw (AI that autonomously performs tasks rather than just reacting to prompts) represents a monumental shift. These technologies enable AI agents to independently "figure out" how to achieve objectives, including bypassing security measures, with minimal human intervention.
6. Persistent Vulnerability of Enterprises: Even large organizations with substantial security resources, such as DraftKings, remain highly susceptible to credential stuffing attacks. The DraftKings incident in 2022, which cost over $300,000 to resolve, underscores the difficulty of defending against these attacks without introducing significant user friction, especially when dealing with a mass consumer base.

These findings collectively paint a picture of an accelerated arms race where attackers, empowered by readily available and increasingly sophisticated AI, are gaining a significant advantage, challenging the very foundations of web security.

Technical Deep Dive

▶ Watch: 16 billion leaked passwords and growing (4:40)

The technical core of the talk revolves around demonstrating how AI agents are leveraging advanced capabilities to perform credential stuffing and evade detection.

At its most basic, credential stuffing begins with obtaining lists of leaked usernames and passwords. These lists are widely available, often through dark web markets, torrent sites, or publicly exposed databases like Troy Hunt's Have I Been Pwned. Attackers then use automated scripts or tools to systematically attempt these credential pairs across a target website's login forms.

The key innovation highlighted is the use of agentic AI to overcome traditional defenses. Christo Roberts demonstrated this with Claude Code, an AI development environment. In an initial demo, Claude Code was instructed to brute-force a password from a list of 1,000 common passwords. The AI, using Playwright (a Node.js library for browser automation), opened a browser instance and systematically tried different passwords. While the live demo stalled, a video confirmed its capability to find the correct password, illustrating the speed and simplicity of leveraging AI for this task.

The more critical aspect was the AI's ability to evade bot detection. When Claude Code's initial attempts were flagged as automated by Cloudflare's bot scoring system (which assigns a score from 1 to 100, with 100 being most human-like), Roberts simply told Claude, "Hey Claude, you're looking automated. That's not cool. You look like a human." In a matter of minutes, Claude autonomously switched its underlying engine to Playwright stealth mode. Subsequent attempts registered a bot score of 89, indicating it was successfully mimicking human behavior and appearing legitimate to Cloudflare's sophisticated bot detection. This demonstrates a significant challenge: AI can dynamically adapt its behavior to bypass even advanced bot management systems.

Beyond bot scoring, attackers also contend with rate limiting. The speakers noted that attackers often use residential mobile proxy IPs to distribute their attack traffic across a vast network of seemingly legitimate, unique IP addresses. This strategy effectively bypasses rate limits that would otherwise block repeated login attempts from a single IP.

The talk then delved into the broader implications of agentic AI, specifically mentioning the Ralph Loop and OpenClaw. The Ralph Loop, inspired by a 9-year-old's suggestion to "put it in a loop," describes an AI system that, given an objective and desired output, autonomously iterates, tests, and self-corrects its code or actions until the goal is achieved. This "YOLO mode" allows the AI to "skip permissions" and rapidly prototype solutions to complex problems, including security evasion. OpenClaw, an AI system designed to perform work autonomously rather than just reacting to prompts, takes this a step further. It actively goes out and performs tasks, such as making bets or payments, and when combined with existing tools like Scrappling (a Python library historically used for CAPTCHA solving), it makes CAPTCHA bypass significantly easier.

A second demonstration, shown via video, highlighted this CAPTCHA-solving prowess. The AI successfully navigated and solved:

• Cloudflare Turnstile
• hCaptcha (an open-source alternative, typically a checkbox)
• Google reCAPTCHA v2 (and it was stated that reCAPTCHA v3, the latest version, also works, despite its lack of a visual element for demo purposes)
• A puzzle-based CAPTCHA referred to as "G test," where the AI visually manipulated elements to solve the puzzle, sometimes on the first attempt.

These demonstrations underscore that CAPTCHAs, once a strong line of defense, are now largely ineffective against AI-driven attacks.

For defensive measures, the talk touched on Cloudflare's integration with Troy Hunt's Have I Been Pwned. When a user attempts to log in to a Cloudflare-protected site, their entered username and password (both hashed on the fly) are compared against the database of compromised credentials. A signal is then sent back, allowing the business to decide on an appropriate action, such as forcing a password change or initiating a step-up authentication.

Finally, the discussion briefly mentioned advanced fingerprinting techniques like JA3 and JA4. These are fingerprints derived from the SSL/TLS handshake metadata. By analyzing these unique fingerprints, defenders can identify patterns of botnet activity, even if requests originate from different IP addresses, as all requests from a specific botnet often share the same JA3/JA4 hash due to consistent client configurations. This, combined with analysis of user agents and Autonomous System Numbers (ASNs), provides additional signals for bot detection, though AI's ability to spoof these remains an evolving challenge.

Demo / Proof of Concept

▶ Watch: Easily downloading massive lists of leaked credentials (5:20)

The talk featured several compelling demonstrations, both live and pre-recorded, to illustrate the ease and effectiveness of AI-driven credential stuffing and evasion.

1. Live Password Cracking Demo (partially stalled):

• Setup: Christo Roberts asked an audience member to choose a word from a list of 1,000 common passwords. The word "dishwasher" was selected and set as a password on a Cloudflare KV store.
• Execution: Using Claude Code, Roberts initiated a script designed to brute-force the password. The script leveraged Playwright to open a browser and attempt login with each password from the list in a random order.
• Outcome: The live demo unfortunately stalled after approximately 60 seconds. However, Roberts quickly pivoted to a pre-recorded video of the same demonstration, which showed the AI successfully identifying "dishwasher" as the correct password and reporting the time taken.
• Purpose: This demo vividly illustrated how quickly and easily an AI agent can execute a credential stuffing attack, even against a simple password, and the potential speed if not for rate limiting or CAPTCHAs.

1. Bot Detection Evasion Demo:

• Setup: Following the password cracking attempt, Roberts showed Cloudflare's bot dashboard, which initially scored the Claude Code traffic as highly automated (low score).
• Execution: Roberts then directly instructed Claude Code: "Hey Claude, you're looking automated. That's not cool. You look like a human." Claude then autonomously adapted its strategy.
• Outcome: Claude switched its underlying browser automation engine to Playwright stealth mode. Subsequent traffic generated by Claude Code registered a bot score of 89 on Cloudflare's system, appearing highly human-like and demonstrating a successful evasion of sophisticated bot detection.
• Purpose: This was a critical demonstration, proving that AI can interpret high-level instructions to bypass advanced security measures, highlighting the obsolescence of purely automation-focused bot detection.

1. CAPTCHA Solving Demo (video):

• Setup: This demonstration showcased AI's ability to solve various CAPTCHA challenges using a known username and password from a database breach.
• Execution: The video displayed the AI (presumably using a combination of OpenClaw and Scrappling) navigating and solving:
• Cloudflare Turnstile: A modern, non-disruptive CAPTCHA.
• hCaptcha: An open-source, often checkbox-based CAPTCHA.
• Google reCAPTCHA v2: The classic "I'm not a robot" checkbox, and it was noted that reCAPTCHA v3 also works.
• "G test": A puzzle-based CAPTCHA requiring visual manipulation to solve, which the AI often completed on the first attempt.
• Outcome: The AI successfully solved all demonstrated CAPTCHAs, underscoring that these common human verification methods are no longer effective deterrents against advanced AI agents.
• Purpose: To reinforce the point that AI has rendered CAPTCHAs largely moot, forcing defenders to rethink their primary human verification strategies.

1. Live DeHashed Service Demo:

• Setup: Roberts used a paid service called DeHashed, which aggregates leaked credentials from various breaches.
• Execution: He first attempted to look up a corporate email address ([email protected]), which yielded no immediate public matches. He then tried a personal email ([email protected]), which revealed two entries. While specific passwords weren't immediately visible in plain text (some were hashed, like "Cisco type 7" or SHA-1, or linked to services like MyFitnessPal), the service provided enough information (usernames, dates of breach) to indicate compromise. Roberts also showed how such hashes could be fed into online cracking services.
• Purpose: This live demonstration concretely showed how easily attackers can access and verify leaked credentials, reinforcing the "supply" side of the credential stuffing problem. It also highlighted the various types of information available to attackers, including VIN numbers and license plates in some breaches (e.g., ParkMobile).

Collectively, these demonstrations provided tangible proof of the talk's core assertions: credential stuffing is easy to perform, AI makes it even easier to evade traditional defenses, and the raw materials for these attacks are readily accessible.

Defensive Implications

▶ Watch: Personal exposure and checking for leaked data (6:00)

The rise of agentic AI necessitates a fundamental shift in defensive strategy against credential stuffing and account takeover. The speakers emphasize moving from merely detecting "automated" traffic to discerning "authentic" behavior, even from AI agents. They propose a layered defense model, likened to an "onion" or a "parfait," comprising four critical layers:

1. Password Layer (Reduce Supply):

• Eliminate Reused Credentials: The most direct approach is to reduce the supply of compromised credentials available to attackers. This involves encouraging or enforcing the use of password managers and adopting more secure authentication methods like passkeys.
• Hardware Security Keys: For higher security environments, leveraging YubiKeys and Titan keys offers robust multi-factor authentication.
• Prevent Weak Passwords: At the application level, implement policies to prevent users from setting easily guessable or commonly breached passwords.
• Reduce Password Sprawl: For enterprises, solutions like Identity Provider (IDP), Single Sign-On (SSO), and Privileged Access Management (PAM) systems can centralize authentication and minimize the number of individual passwords users manage.

1. Request Layer (Detect and Challenge Automation):

• Detect and Challenge Automated Traffic: While AI can evade basic bot detection, continuous evolution of bot management systems is necessary to identify and challenge increasingly sophisticated automated requests.
• Slow Down Velocity: Implement rate limiting and throttling mechanisms to slow down credential stuffing attempts. Although attackers can use residential proxies, effective rate limiting can increase the cost and complexity for them.
• Disrupt Infrastructure: Actively identify and block traffic originating from known malicious infrastructure, such as certain VPNs, proxies, or virtual machine (VM) environments commonly used by attackers. Utilizing JA3 and JA4 fingerprints can help detect botnets even across distributed IPs.

1. Account Layer (Behavioral Detection):

• Monitor Behavior Across Sessions: Track user behavior patterns both pre-login and post-login. Look for anomalies such as logins from unusual geographic locations, sudden changes in user agents, or attempts to access sensitive functions immediately after login without typical browsing behavior.
• Identify Abnormal Post-Login Behavior: An attacker who successfully logs in often behaves differently from a legitimate user. Examples include immediately changing the password, attempting illicit purchases, or scraping PII, rather than checking account balances or browsing.
• Increase MFA/Friction: For users exhibiting suspicious behavior, implement step-up authentication by requiring additional multi-factor authentication (MFA) challenges or increasing friction through other security prompts. This allows for dynamic risk assessment without uniformly burdening all users. Cloudflare's Hashed User IDs can aid in analyzing individual user activity for suspicious patterns.

1. Agent Layer (Define Trust for Autonomous Agents):

• Define Trust Boundaries: This is the newest and most challenging layer. Given that legitimate agents (e.g., AI assistants performing tasks on behalf of a user) will become more prevalent, defenders must define how to establish trust.
• Signed Requests and Proof of Possession: Implement mechanisms like cryptographically signed requests or proof of possession to verify the authenticity and authorization of an agent.
• Authorize Agents and Policy Enforcement: Establish clear policies for what agents are allowed to do and ensure that agents operate within these defined permissions.
• Context-Based Access Decisions: Move beyond simple token-based access to more granular, context-aware access decisions that consider factors like device posture, location, time of day, and historical behavior.
• Industry-Wide Controls and Training: Promote better industry standards for agent security, including secure development practices, regular audits, and user training on safe agent usage.

The speakers acknowledge that there are "no silver bullets" and that this is an ongoing "cat and mouse game." The ultimate goal is to make attacks more costly and complex for adversaries, while minimizing friction for legitimate users. This requires constant adaptation, leveraging analytics (like Cloudflare's sequence analytics API to detect unusual user flows), and continuously questioning what constitutes "authentic" behavior in an increasingly AI-driven digital world.

Key Takeaways

• Credential stuffing is an escalating threat: Driven by widespread password reuse and the easy availability of billions of leaked credentials, this attack vector poses a significant and growing risk to individuals and organizations alike.
• Agentic AI fundamentally changes the attack landscape: Tools like Claude Code with Playwright stealth mode and OpenClaw enable attackers to easily bypass traditional bot detection and CAPTCHAs, making sophisticated attacks accessible to a broader range of adversaries.
• Defensive focus must shift to "authenticity": It's no longer sufficient to merely detect automated traffic. Defenders must evolve to discern genuine user behavior and legitimate agent activity from malicious AI, even when both appear human-like.
• Layered defense is paramount but requires continuous adaptation: A comprehensive strategy encompassing password hygiene, request-level bot management, behavioral account monitoring, and new controls for autonomous agents (the "parfait" model) is essential. However, these layers must constantly evolve to counter ever-smarter AI.
• Individuals must be proactive in self-defense: Users should regularly check services like Have I Been Pwned, utilize strong, unique passwords via password managers, and enable multi-factor authentication (MFA) wherever possible to protect their accounts.
• Organizations face a complex, ongoing challenge: Even well-resourced companies struggle to defend against AI-driven credential stuffing without introducing excessive user friction. The solution lies in dynamic, context-aware security measures, leveraging advanced analytics, and embracing the "assume breach" mentality to monitor post-login behavior.

About the Speaker(s)

Christo Roberts is a Principal Product Manager at Cloudflare, bringing approximately 25 years of experience in the industry. Prior to his four years at Cloudflare, he spent seven years at Akamai. His work at these prominent content delivery network and cybersecurity companies has involved supporting large social networks and major corporations, including those that run Super Bowl advertisements. Roberts's passion for musicals is evident, with his favorite being "Tommy," though he humorously noted that his new favorite is "Hope vs. Anon," a musical he created for BSides SF using AI.

Dan Hollinger is a seasoned Product Leader with over 10 years of experience in the technology sector. His career includes significant roles at early Cloudflare, Zscaler, and in identity security at Vezza. Hollinger's background spans cloud security and identity management, giving him deep insights into the challenges and solutions discussed in the talk. His favorite musical is "Hamilton," adding a touch of personal flair to the presentation.