What you're describing gets covered by OWASP as "credential stuffing"
You can find it as A2 in the current (RC2) draft OWASP Top 10 and on the wiki here https://www.owasp.org/index.php/Credential_stuffing
You can find it as A2 in the current (RC2) draft OWASP Top 10 and on the wiki here https://www.owasp.org/index.php/Credential_stuffing
Btw I feel like this should be in the top 10 list right? With mitigation strategies?