Credential attacks are attempts to obtain, guess, or test usernames and passwords so an attacker can log in as a real user. Common forms include phishing for passwords, password spraying, brute-force guessing, and credential stuffing, where stolen logins from one breach are reused against other services.
They matter because valid credentials often bypass perimeter defenses: the login looks legitimate, so security tools may see normal authentication rather than obvious malware. In real intrusions, attackers use credential attacks to enter email, VPN, cloud, or government systems, then move deeper with trusted access. Defenses focus on phishing-resistant MFA, strong password policies, account lockout and rate limits, suspicious-login detection, privilege separation, and rapid reset of exposed accounts. Good logging is essential, because spotting valid-account abuse early can stop lateral movement and data theft.