Account takeover

How it works

The attacker does not need to break in. They sign in as the legitimate user, and the service accepts it. MITRE ATT&CK describes the use of valid accounts as a way to gain initial access, persistence, privilege escalation or defense evasion, and notes that compromised credentials can bypass access controls on remote services such as VPNs and remote desktop. It also notes that adversaries may target inactive accounts, because the real owner is unlikely to notice anything unusual.

The routes in are familiar: a password stolen in a breach, credential stuffing that replays it elsewhere, a stolen session cookie, or a phishing page. MITRE's account compromise technique also lists buying credentials from third-party sites and using breach dumps.

How it shows up in executive exposure

An executive account is valuable because it carries authority. A taken-over mailbox can be used to approve payments, request data or message staff with a trusted name. Breach and leak data show the starting material: exposed addresses, passwords and the breaches they came from. They do not show whether any account was taken over.

WebThreat's CEM checks each executive's addresses against breach corpora and leak databases and shows which leaders hold the most exposed passwords, so the first resets and multi-factor rollouts go where takeover risk is highest. The methodology lists the factors behind the ranking.

How to reduce the risk

• Use multi-factor authentication, with hardware keys for the highest-value accounts.
• Use unique passwords and reset any that appear in a breach.
• Review sign-in logs for logins from unusual places, devices or times.
• Disable or remove inactive accounts.
• Prepare a short response plan: revoke sessions, reset credentials, review mailbox rules.

How it differs from related terms

Credential stuffing is a method. Account takeover is the result. Password reuse is a condition that raises the odds. A data breach is a different event: the service loses data, and a takeover may follow later on a different service. See what to do when an executive's password is in a breach.