Credential Stuffing is a special type of brute-force attack, in which the attacker injects a list of previously breached username and passowords into the target to find a matching account and gain access to the application. A successful attack results in the account take-over and lets the attacker access to the victim's account. From the user's point of view, it is crutial to avoid using similar passwords in different sites, so that the breached accounts could not be used to access other sites. Furthermore, users should avoid using simple passwords. On the other hand, applications should enforce password security policies such as password complexity and length rules as well as preventing password reuse. In addition, multi-factor authentication would be a better solution. There is a comprehensive OWASP cheat sheet for prevention techniques.
OWASP credential stuffing page
