Academy
TermAttack

Account takeover

(ATO)

An attacker signing in to an account as its owner with a stolen password, cookie or access key and using it.

Flow

  1. 1Access obtained
  2. 2Signs in
  3. 3Persistence set
  4. 4Used
Related families
Lumma Stealer
MITRE ATT&CK
T1078 · Valid Accounts
Sources
6 sources
01

Overview

Account takeover is an outcome; the path to it is a credential leak, session cookie theft or credential stuffing. Because the attacker signs in with a legitimate account, most security controls raise no alarm. MITRE ATT&CK

A stolen session cookie can be enough to sign in without being asked for a password or multi-factor authentication. MITRE ATT&CK

02

How it works

  1. 1

    Access obtained

    From a log, a leak list or a phishing page. MITRE ATT&CK

  2. 2

    Signs in

    With a password or cookie; often through a proxy in the victim’s country. MITRE ATT&CK

  3. 3

    Persistence set

    The recovery email, verification method or forwarding rules are changed. MITRE ATT&CK

  4. 4

    Used

    Data is stolen, payments are redirected or the account is used in new phishing.

03

Real-world examples

Snowflake: no multi-factor authentication

According to Mandiant, multi-factor authentication was not enabled on the affected Snowflake accounts; entering a valid username and password was enough. Google Cloud (Mandiant)

04

How to detect it

  • A new verification method, recovery address or email forwarding rule being added to the account. MITRE ATT&CK
  • The same session being used from different countries within a short time. MITRE ATT&CK
05

What to do

  • Move to phishing-resistant multi-factor authentication. MITRE ATT&CK
  • Restrict access to critical systems to trusted networks; this restriction was also missing in the Snowflake incident. Google Cloud (Mandiant)
06

MITRE ATT&CK

T1078Valid AccountsT1550.004Web Session CookieT1556Modify Authentication Process
07

Related families and terms

Families

Lumma StealerActive

Report

Infostealer Threat Report — October 2026

Terms

MFA bypassSession hijackingCredential stuffingCredential leak
08

Sources

  1. 1Valid Accounts (T1078) · MITRE ATT&CK
  2. 2Web Session Cookie (T1550.004) · MITRE ATT&CK
  3. 3Modify Authentication Process (T1556) · MITRE ATT&CK
  4. 4UNC5537 targets Snowflake customer instances · Google Cloud (Mandiant), 2024
  5. 5Lumma Stealer — family entry and report index · Malpedia (Fraunhofer FKIE)
  6. 6Multi-factor Authentication (M1032) · MITRE ATT&CK
From the Essential plan

Infostealer Detection

See your firm's attack surface on one screen: how many findings, at which severity, on which domain.

View productCompare plans