An attacker abuses weak password reuse across services using leaked credentials.

The correct answer is B because credential stuffing uses previously leaked or stolen username-password pairs against other services, relying on the common user behavior of reusing passwords across multiple platforms. In CEH authentication and password-attack concepts, weak password practices and compromised credentials are major causes of unauthorized access. The CEH-aligned material notes that weak password policies allow attackers to bypass weak credentials, and credentials exposed through insecure channels can lead to compromise. Credential stuffing differs from brute force because the attacker is not trying every possible password combination. It also differs from a dictionary attack because the attacker is not testing dictionary words; instead, they are testing known leaked credentials. Replay attacks reuse captured authentication data or session tokens, but the question specifically mentions weak password reuse across services using leaked credentials. Therefore, the best and most precise answer is credential stuffing.