Kdjykuj

Wikipedia describes credential stuffing as

a type of cyberattack where stolen account credentials typically
consisting of lists of usernames and/or email addresses and the
corresponding passwords (often from a data breach) are used to gain
unauthorized access to user accounts through large-scale automated
login. Credential Stuffing attacks are made possible because many users will reuse the same password across many sites

Interestingly there doesn't appear to be Wikipedia article on password spraying. Double Octopus describes it as

Password spraying is an attack that that attempts to access a large
number of accounts (usernames) with a few commonly used passwords. Password spraying is an attack that that attempts to access a large number of accounts (usernames) with a few commonly used passwords.

It seems that password spraying and credential stuffing are similar in the objectives and approach. It isn't clear as to the discrete difference between the terms. Are there any and if yes, what would these be?

• 
  Credential Stuffing - is a type of attack where users reuse the same password and username accross sites. For example: say StackExchange was compromised and my account and password where leaked. Then an attacker would search other social media sites for users with the name MeowCat and try the leaked password.


• 
  Password Spraying - is a type of brute force attacked that is used so that accounts do not get locked out. If a program locks an account after say 5 incorrect guesses, then a password spray will only attempt the 4 most common passwords for any account and move on to another account (They typically will not use 5 as then the site might become suspicious if all of their users are locked out).

• Credential stuffing - use a bunch of usernames and passwords which are known to be associated with them to try and access multiple sites


• Password spraying - use a list of usernames and some common passwords (which aren't known to have been used by someone with the usernames being sent) to try and gain access to a single site

The key difference is whether the password is known to be associated with the account or not, and whether the attack aims to get access to a single site, or to multiple sites.