Most intrusions do not begin with a clever exploit. They begin with someone logging in.
That sentence is worth sitting with, because it contradicts how the job is usually taught. An attacker who has a working username and password does not need a vulnerability. They are not breaking in; they are walking in, and every control you built to stop code from executing is irrelevant to them.
Three things a system can check
There are three things a system can check about you. Something you know, which is a password. Something you have, which is a phone or a hardware key. Something you are, which is a fingerprint or a face. A password alone is the weakest of the three, and it is the one almost everything still defaults to.
The reason password reuse matters is arithmetic, not morality. A person has perhaps two hundred accounts and perhaps four passwords. When any one of those services is breached — and one of them will be — the attacker does not get one account. They get a list, and they replay it everywhere. This is credential stuffing, and it works because the arithmetic is on their side.
What a stuffing run looks like
A credential-stuffing run looks unmistakable in authentication logs once you have seen one: failures rise sharply and suddenly, while successful logins barely move. The pattern is unmistakable once you have seen it. Huge volume, distributed usernames, almost total failure — because the attacker is testing a list harvested somewhere else entirely.
A night of sign-ins. Count by result first, then by account. The shape of a stuffing run is in the first; which account it reached is in neither, and that is the point — you have to read a line.
02:12:17 a.hassan failed 198.51.100.23 02:13:50 d.ibrahim failed 198.51.100.23 02:15:36 h.qadir failed 198.51.100.23 02:16:52 j.salih failed 198.51.100.23 02:18:20 k.aziz failed 198.51.100.23 02:18:58 m.taha failed 198.51.100.23 02:19:36 n.barzan failed 198.51.100.23 02:20:00 r.othman failed 198.51.100.23 02:21:49 s.rashid failed 198.51.100.23 02:23:20 z.karim failed 198.51.100.23 02:23:48 a.hassan failed 198.51.100.23 02:24:13 d.ibrahim failed 198.51.100.23 02:24:42 h.qadir failed 198.51.100.23 02:25:17 j.salih failed 198.51.100.23 02:26:04 k.aziz failed 198.51.100.23 02:27:35 m.taha failed 198.51.100.23 02:28:28 n.barzan failed 198.51.100.23 02:28:52 r.othman failed 198.51.100.23 02:30:39 s.rashid failed 198.51.100.23 02:31:57 z.karim failed 198.51.100.23 02:33:33 a.hassan failed 198.51.100.23 02:34:47 d.ibrahim failed 198.51.100.23 02:35:21 h.qadir failed 198.51.100.23 02:36:22 j.salih failed 198.51.100.23 02:38:08 k.aziz failed 198.51.100.23 02:39:25 m.taha failed 198.51.100.23 02:40:19 n.barzan failed 198.51.100.23 02:41:12 r.othman failed 198.51.100.23 02:41:42 s.rashid failed 198.51.100.23 02:42:51 z.karim failed 198.51.100.23 02:43:26 a.hassan failed 198.51.100.23 02:45:10 d.ibrahim failed 198.51.100.23 02:45:36 h.qadir failed 198.51.100.23 02:46:46 j.salih failed 198.51.100.23 02:47:56 k.aziz failed 198.51.100.23 02:49:09 m.taha failed 198.51.100.23 02:50:02 n.barzan failed 198.51.100.23 02:51:39 r.othman failed 198.51.100.23 02:52:59 s.rashid failed 198.51.100.23 02:54:31 z.karim failed 198.51.100.23 02:56:13 a.hassan failed 198.51.100.23 02:56:43 d.ibrahim failed 198.51.100.23 02:57:13 h.qadir failed 198.51.100.23 02:58:16 j.salih failed 198.51.100.23 02:58:38 k.aziz failed 198.51.100.23 02:59:25 m.taha failed 198.51.100.23 03:00:42 n.barzan failed 198.51.100.23 03:01:30 r.othman failed 198.51.100.23 03:03:04 s.rashid failed 198.51.100.23 03:04:36 z.karim failed 198.51.100.23 03:05:48 a.hassan failed 198.51.100.23 03:06:15 d.ibrahim failed 198.51.100.23 03:07:09 h.qadir failed 198.51.100.23 03:08:54 j.salih failed 198.51.100.23 03:09:17 k.aziz failed 198.51.100.23 03:11:02 m.taha failed 198.51.100.23 03:12:44 n.barzan failed 198.51.100.23 03:13:43 r.othman failed 198.51.100.23 03:14:47 m.taha ok 198.51.100.23 09:02:14 s.rashid ok 10.4.1.56 09:07:41 a.hassan ok 10.4.1.22
Credential stuffing only works at scale where password reuse is common and the second factor is optional. That is why the defence is not telling people to choose better passwords — it is making the second factor the default rather than a setting somebody has to find.
After the door
One more thing, because it is the part people miss. After you authenticate, the system stops checking your password and starts trusting a session token. Steal the token and you skip authentication entirely — which is why "we have MFA" is not the end of the conversation. Sessions expire, are bound to a device, and are revocable, or they are a password with extra steps.