An attacker uses one common password against hundreds of employee accounts while avoiding repeated failures against any single account. Which attack is this?

1. Credential stuffing
2. Password spraying
3. Session fixation
4. Offline hash cracking