The Rise of OpenBullet: A Deep Dive in the Attacker’s ATO Toolkit

This report outlines how account takeover (ATO) is enabled by the widespread availability of stolen credentials (citing ~15 billion credentials) and commoditized tooling—brute-force crackers, credential stuffing suites, and account checkers (e.g., OpenBullet, Sentry MBA, BlackBullet, Private Keeper)—sold or shared across criminal marketplaces; it describes attacker workflows, examples of tools and configurations, the ease of scaling attacks via proxies/botnets, and the downstream impacts on organizations.