VoIP Credential Stuffing

VoIP credential stuffing applies the standard credential-stuffing technique to internet telephony accounts. Attackers obtain large password-breach databases from criminal markets and test the credentials against SIP account portals, carrier APIs, and business phone system management panels. Because many users reuse passwords across services, even a breach of an unrelated website can yield working VoIP credentials.

A compromised VoIP account can be used to make fraudulent international calls at the account holder's expense, serve as an origination point for robocall or smishing campaigns, send authenticated caller-ID calls to bypass spam filters, or be resold as a resource for other fraud operations. The attacks are highly automated and can test millions of credential pairs per day against a single target.

Defences include using strong, unique passwords for any VoIP or carrier account, enabling multi-factor authentication on VoIP portals wherever available, monitoring for unexpected call activity, and setting hard international dialling limits. Business IT teams should include VoIP accounts in their standard credential-hygiene and breach-monitoring programmes.