RSA Thursday | Identity Security Series Issue #14 | Account Takeover: What If the Right Credentials Are in the Wrong Hands?

An attacker does not always need to breach a firewall, exploit a server vulnerability or use a complex exploit to enter an organization.

Sometimes, all they need is a real user's identity.

The username is correct. The password is correct. Sometimes, even MFA is completed successfully. To the system, everything looks like a legitimate user. In reality, however, the attacker is in control of the account. This is the fundamental danger of Account Takeover (ATO).

The attacker enters using an identity the organization already trusts, rather than their own.

How Do Attackers Take Over Accounts?

Account takeover is not the result of a single attack method. Attackers can acquire credentials in many ways:

• Phishing and social engineering

• Credential phishing

• Previously leaked usernames and passwords

• Credential stuffing

• Password spraying

• MFA fatigue attacks

• Session cookie or token theft

• Infostealer malware

• Fake login pages

When users reuse the same or similar passwords across systems, credentials stolen elsewhere can be tested against corporate accounts.

An organization's accounts can therefore be at risk even if it has not suffered a data breach itself.

Does MFA Put an End to Account Takeover?

MFA is one of the most important controls in identity security and significantly reduces risk. However, it does not eliminate every account takeover scenario. Modern attacks do not target passwords alone.

An attacker may trick a user into a fake authentication process, persuade them to approve an MFA request, or steal a session token after authentication.

In Adversary-in-the-Middle (AiTM) phishing, for example, an attacker positions themselves between the user and the legitimate service to target the session established after successful authentication.

The system sees successful authentication. But the person using the session may not be the legitimate user. The question for modern identity security should therefore go beyond "Was MFA completed?" It must also ask:

"Can this authentication and the resulting session be trusted?"

The First Signs of Account Takeover

An attacker may not immediately target critical systems after compromising an account. They may first explore the environment, examine the user's access rights, try to mimic normal user behavior and wait for the right moment to reach more valuable systems. During this process, certain signals may indicate rising identity risk:

• Access from previously unseen devices

• Logins from unusual locations or at unusual times

• Sessions from different locations within a short period

• Access to applications the user does not normally use

• Unexpected MFA requests

• Sudden changes in authentication behavior

• Unusual resource access or privilege use

• Deviations from the user's historical behavior

No single signal necessarily indicates an attack.

Together, however, these signals become more meaningful when evaluated in the context of the identity.

Authentication Is a Moment. Security Is a Process.

The traditional model was relatively simple:

Credential → Authentication → Access

Modern attack techniques expose the limitations of that model. Risk does not exist only at login. After a session begins, the user's device, location, behavior, resources accessed and actions performed can all change.

Access decisions should therefore not be treated as a one-time event:

Authenticate → Evaluate → Monitor → Re-evaluate

This approach allows trust to be evaluated continuously after authentication.

When risk is detected, organizations can require additional authentication, reassess the session or restrict access to critical resources.

How Does Passwordless Authentication Change Account Takeover?

Passwords remain one of the primary targets in identity attacks. Phishing-resistant passwordless approaches can reduce this attack surface.

FIDO-based methods can significantly reduce the risk of users disclosing passwords or authentication credentials through phishing.

However, passwordless authentication is not the whole of identity security. Even when the attack surface shrinks, session security, device trust, access policies and behavioral analysis remain important.

The goal is not merely to remove passwords, but to make the entire identity process more trustworthy.

Account Takeover Is an Identity Problem

Account takeover is sometimes treated purely as a phishing or endpoint security issue.

Yet identity is usually at the center of the attack. The attacker compromises an identity, exploits the trust placed in it, uses its access rights and tries to behave like the legitimate user.

Defense must therefore go beyond blocking attackers: it must continuously assess whether the right person is using the identity.

Strong authentication, passwordless approaches, adaptive risk signals and continuous assurance can make compromised accounts less useful to attackers.

Key Takeaway

The most dangerous attacker is sometimes the one who does not look like an attacker at all.

A correct username, valid credentials and successful authentication do not always guarantee that the person accessing the account is its rightful owner.

Modern identity security aims not only to authenticate users, but to assess whether the right person is using the identity throughout the access process.

An attacker's most powerful identity may be one your organization already trusts.

Zero Second | RSA – Identity Security.

RSA Thursday | Identity Security Series Issue #14, prepared by Zero Second.