Credential stuffing evades login alarms

Overnight your login endpoint's success rate barely moved (down 2%) and total volume is only up ~15%, nothing tripped your failed-login or volume alarms. But fraud reports of unauthorized logins climb the next morning. Digging in: a credential-stuffing run used a known-good combo list, so most attempts succeeded on the first try (low failure rate by design), spread across ~80k residential-proxy IPs at <1 req/min each, mimicking real user-agents and pacing. The attempts cluster on accounts that have no 2FA. How do you confirm this is stuffing (vs. a normal night), contain it, and harden, while a Black-Friday-style real traffic surge is also happening so you can't just clamp logins?