An attack that doesn't touch the target's own defenses
Credential stuffing takes username-and-password pairs exposed in one service's breach and tries them automatically, at scale, against many unrelated services — succeeding purely because people reuse passwords across accounts, not because of any weakness in the targeted service itself. A service with excellent internal security can still be a stuffing target if enough of its users reused a password that leaked somewhere else entirely.
This is what makes credential stuffing hard to defend against with the usual application-security toolkit: there's no vulnerability to patch, because nothing about the target's own code or infrastructure is being exploited. The credentials being used genuinely are valid.
What the resulting takeover looks like, and how it's caught
Once an attacker has valid credentials, the resulting session is, from the target service's perspective, indistinguishable from a legitimate login — the credentials check out. Catching a takeover in progress depends on signals beyond credential validity: an unfamiliar device or location, request patterns automated stuffing produces, or behavior inconsistent with how the account is normally used.
Defenses concentrate accordingly on the layers that don't depend on a unique or strong password: rate-limiting login attempts to slow bulk automated tries, and requiring a second factor a stuffed password alone can't satisfy.