What is 'credential stuffing' and how does it differ from a brute-force attack?

• A.Credential stuffing guesses passwords one character at a time against a single account (a slow, patient search), exploiting weak lockout policies. Brute force replays leaked pairs from earlier breaches, trying every combination of those stolen values against other sites
• B.Credential stuffing uses a dictionary of common passwords (not leaked pairs) against one username, exploiting weak policies. Brute force tries all common passwords against many usernames
• C.Credential stuffing floods a login page with requests (a denial of service), exploiting server capacity. Brute force does not target accounts directly, only the network
• D.Credential stuffing uses known username/password pairs from previous data breaches (not random guesses) to attempt login at other sites, exploiting password reuse. Brute force tries all possible character combinations