Credential stuffing
Using username and password pairs stolen from one breach to log into unrelated services.
It is not guessing, it is reuse. Billions of real credentials are available from past breaches, and because people reuse passwords across personal and work accounts, a leak from an unrelated consumer site regularly yields a working corporate login.
MFA is the control that breaks it, along with checking your own domains against breach corpora so you know which accounts are already exposed.
Where this comes up
Credential stuffing sits inside our cybersecurity and threats work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.