whitelist-bypass – WebRTC Tunnels Through Video-Calling Platforms

Credential stuffing has become the most common initial access vector in 2025, driven by infostealer malware that harvests browser-stored credentials and a commodified supply chain that sells fresh combolists and attack configs on dark web markets; widely available frameworks (OpenBullet/SilverBullet), proxy networks, and CAPTCHA-solving services enable large-scale, low-cost campaigns that have led to tens of thousands of account compromises and major disruptions (notably the Change Healthcare/ALPHV incident). The report covers detection and evasion techniques, regulatory responses, and a CISO playbook prioritizing phishing-resistant MFA, password screening against breach corpora, rate limiting, and behavioral bot detection.