I think everyone has made it clear, I am just giving in the field practical examples.
This kind of attack is started through acquired leaked account credentials from an exposed source (e.g. exposed by bad website, hacking, etc). Haved I been pwned has a huge db of exposed accounts for a researcher to download.
To initiate the attack, the attacker just uses a script to skim through those exposed user credentials and trying to use it against any social network or important services platform to gain access. For example, an attacker gets a list of leaked password of Website XYZ, where user "JoeTiger" is using password "Meow@1234@7890".
The attacker then just uses this information to construct a series of account names with the user name e.g. [email protected], [email protected], etc with the same password.
Then the attacker will use this generated user name (and the mentioned password) and try login to all potential web services account, e.g. Amazon, Gmail, Linkedin, Netflix, Quara, Quicken etc using the password "Meow@1234@7890" even though the user may not using those services.
This kind of attack is using the most frequently used passwords against accounts 10,000 most common passwords. To launch the attack, the attacker simply acquires any active email address list (this can be bought from darknet/ hacking/ download from exposed systems), then they use a script that brute force/cycling through the password against all the account lists until it gains access.
Prominent web services like Amazon, Google, etc are imposing login limits, making brute force attack less likely to be carried out over such services. To prevent a immediate login limit blocking. These attacks are mostly carried out from infected machine, i.e. Botnet to spread the attack.