Would be interesting to know if they fit the ‘classic’ credential stuffing methodology (https://breachinsider.com/blog/2017/credential-stuffing-how-...) or if they have moved on to something more sophisticated.

My email is in my profile if you fancy talking specifics, would love to hear about what you’re seeing.