Account Takeover (ATO)
When an attacker gains control of a legitimate account, often via stolen credentials, phishing, or session theft. A leading cause of breaches and fraud.
The distinguishing feature of ATO is that nothing looks broken: the login succeeds, the log line is normal, and detection has to come from behavior rather than from a failure. The three supply chains feeding it are infostealer logs, credential dumps replayed against unrelated sites, and real-time relay kits that capture a valid session. Each defeats a different control, which is why layered detection plus phishing-resistant credentials beats any single fix.
See also: credential stuffing, session hijacking, what is ITDR, infostealer session hijacking teardown
Related on Start with Identity
- GlossaryAdversary-in-the-Middle (AitM)
Adversary-in-the-middle (AitM, written AiTM by MITRE) is an attack in which the attacker positions itself between two parties, such as a user and a sign-in serv
- GlossaryInfostealer
Malware that harvests credentials, cookies, and session tokens from infected devices, then sells them. A major driver of recent account-takeover and session-the
- GlossaryLateral Movement
How an attacker moves from an initial foothold to other systems and accounts, often abusing identity and trust relationships. A primary target of identity threa
- ArticleStopping Account Takeover in CIAM: Bot, Fraud and ATO Defense
How customer accounts actually get taken over, and the four layers of defense a CIAM program needs: bot and stuffing controls, phishing-resistant credentials, r
- BlogOkta buys Permiso Security to put ITDR inside the identity provider
Okta signed a definitive agreement to acquire Permiso Security, reportedly for just under 200 million dollars in an almost all-cash deal. It moves detection of
- PodcastSemperis
Semperis' biweekly show for defenders of hybrid Active Directory and Entra ID environments, hosted by 15-time Microsoft MVP Sean Deuby.