Skip to content
Cyber Unboxed

Account takeover

Credential Attacks

Credential attacks aim to get valid usernames and passwords, or sessions, by phishing, malware, guessing or reuse. Once they succeed, attackers can look like ordinary users.

Motivation: Access: a valid login lets attackers act as a real user, which is quieter than breaking in.

Overview

Most people picture hacking as breaking through security. Very often it is much simpler: the attacker obtains a real login. A valid account is worth more than a technical exploit because it looks like normal activity, and it may reach everything the person can.

Logins are obtained in several ways. Phishing pages collect them directly. Malware on a device copies passwords and cookies saved in the browser. Leaked passwords from other websites are tried elsewhere, which works whenever people reuse a password. And attackers try a few very common passwords against many accounts, staying below the point where a lockout would trigger.

Multi-factor authentication makes most of these attacks much harder, but it is not a complete answer. Attackers can relay a login live, tire a user into approving a prompt, or steal the session after sign-in. Phishing-resistant methods, unique passwords and monitoring for unusual sign-ins close most of those gaps.

How it unfolds

  1. 1

    Obtain

    Phish, steal, buy, guess or reuse credentials from another leak.

  2. 2

    Test

    Try them against real services, often automatically and slowly.

  3. 3

    Sign in

    Use a working login, appearing as a normal user.

  4. 4

    Expand

    Look for more access, set up persistence and change security settings.

  5. 5

    Act

    Read data, send fraud emails or move deeper into the network.

Common techniques

  • Password spraying

    A few common passwords tried across many accounts to avoid lockouts.

  • Credential stuffing

    Leaked username and password pairs replayed on other services.

  • Infostealer malware

    Software that copies saved passwords and session cookies from a device.

  • MFA fatigue

    Repeated approval prompts until a user accepts one.

  • Session theft

    Stealing a signed-in session so the login step is skipped entirely.

Who is targeted

  • Email and single sign-on accounts, which unlock everything else
  • Administrators and privileged accounts
  • Anyone who reuses a password across services
  • Internet-facing login pages without MFA

An example

A person reuses one password on a forum and on their work email. The forum's data is leaked. Someone tries the same password on the work sign-in page, and it works because nothing else stood in the way. The sign-in looks normal, so it is only noticed when the account starts sending unusual messages.

An illustrative scenario, not a report of a specific incident.

What to look for

  • Many failed sign-ins across many accounts from one source
  • Successful sign-ins from new devices, countries or hosting providers
  • An account suddenly reaching systems it has never used
  • Password or MFA changes shortly after an unusual sign-in

How to defend

  1. Use a password manager so every account has a unique password
  2. Turn on MFA everywhere, and prefer passkeys or security keys for important accounts
  3. Alert on impossible travel, new devices and many failures from one source
  4. Give accounts the least access they need, and separate administrator accounts
  5. Have a fast process to reset credentials and revoke sessions after a suspected compromise

Key terms

Credential stuffing
Trying leaked login pairs on other websites.
Password spraying
Trying a few common passwords against many accounts.
Infostealer
Malware that collects saved logins and cookies.
Passkey
A phishing-resistant login method that replaces the password.

This is a general profile of a type of threat. It does not attribute any specific incident to any named group.

Go deeper on credential attacks

Back to the Threat Atlas