# account-takeover

Source: https://startwithidentity.com/glossary/account-takeover/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

When an attacker gains control of a legitimate account, often via stolen credentials, phishing, or session theft. A leading cause of breaches and fraud.

The distinguishing feature of ATO is that nothing looks broken: the login succeeds, the log line is normal, and detection has to come from behavior rather than from a failure. The three supply chains feeding it are infostealer logs, credential dumps replayed against unrelated sites, and real-time relay kits that capture a valid session. Each defeats a different control, which is why layered detection plus phishing-resistant credentials beats any single fix.

See also: [credential stuffing](https://startwithidentity.com/glossary/credential-stuffing/), [session hijacking](https://startwithidentity.com/glossary/session-hijacking/), [what is ITDR](https://startwithidentity.com/guides/fundamentals/what-is-itdr/), [infostealer session hijacking teardown](https://startwithidentity.com/breaches/infostealer-session-hijacking/)