Compromised Accounts Are Being Weaponized – Stop Credential Compromise Now
By The Mimecast Cyber Insights Blog Team ·
Key Points
Strengthening authentication methods and educating users are pivotal in combating credential compromise in an increasingly complex digital landscape.
Early detection through endpoint visibility and behavioral baselines, combined with swift, informed responses, significantly reduces the fallout from compromised accounts.
Credential Compromise: What You Need to Know
Compromised user accounts have always been the most significant — and simplest — cybersecurity risk in the enterprise. Stolen credentials were the vector of choice for more than 40% of attacks in 2022, according to Verizon’s 2022 Data Breach Investigations Report. User credentials also comprise 63% of stolen data — clearly showing that your organization isn’t the only one that understands its value.
After all, the easiest way to “get in” to a system or access valuable data or assets is to have the “key” provided by legitimate user credentials. But here’s the part that is alarming: The incidence of compromised credentials and compromised user accounts is on the rise.
How Credentials Become Compromised
Credential theft doesn’t always start with advanced exploits — most compromised credentials attacks begin with simple mistakes, poor digital hygiene, or reused passwords. Attackers know it’s easier to walk in with valid credentials than to break in.
Common pathways include:
Phishing and social engineering: The most prevalent method of stealing login credentials, often disguised as legitimate password-reset requests or collaboration invites.
Brute force and dictionary attacks: Automated tools guess weak or reused compromised passwords until they gain access.
Infostealers and keyloggers:Malware silently collects stored passwords or autofill data from browsers and password managers.
OAuth and token abuse: Attackers trick users into granting excessive access permissions to malicious applications.
Dark web resale: Massive credential dumps from previous breaches feed new waves of credential abuse across multiple services
Each of these entry points targets the weakest link - human trust - and leverages it to infiltrate systems without raising immediate alarms.
Related Tags
Threat Intelligence
Share this
Understanding Credential Compromise in a Post-Pandemic World
According to Microsoft, attacks targeting passwords and user credentials rose by 74% in 2022, at the rate of 921 attacks per second. A stunning 75% of human-operated ransomware attacks were also executed with compromised user accounts that had elevated access. In fact, compromised credentials are now the most common source of cyberattack that organizations are facing.
What’s behind the rise in compromised accounts? Employees were the cause of 22% of data leaks — with 36% of those being performed by disgruntled employees. And as Verizon noted, one of the most popular data types for cybercriminals to gobble up is credentials. Most organizations are adjusting to the idea of a hybrid workforce, and have gone full steam ahead with policies around BYOD, cloud-based apps for productivity and sharing, and more. In the post-pandemic era, this all adds up to a much broader digital landscape — or threatscape. More accounts and more user credentials. More remote and off-network activity. All culminating in a heightened risk of a breach because identity security can’t keep up quickly enough. Take this stat, for example: only 40% of enterprises have either no MFA or weak MFA in place, leaving many devices and accounts unsecured.
Risks and Consequences of Compromised Credentials
When login credentials fall into the wrong hands, the damage goes beyond data loss. The true cost lies in the operational and reputational impact of a successful breach.
Data exposure: Compromised accounts give attackers direct access to sensitive information — from customer records and intellectual property to internal communications.
Business disruption: Attackers can exploit compromised credentials to deploy ransomware or manipulate financial transactions.
Regulatory penalties: Unauthorized data access often violates privacy laws, resulting in fines and compliance violations.
Account Takeover (ATO): Threat actors use valid credentials to impersonate executives, reset MFA, or initiate internal phishing campaigns.
Blind spots in security operations: Because these actions appear “legitimate,” they often bypass traditional perimeter defenses and alert thresholds.
In short, compromised credentials don't just open a door - they create a trusted pathway for attackers to operate invisibly.
Types of Credential Theft
There are countless varieties of attacks, schemes, and plots to harvest compromised credentials. But most can be broken into three categories:
Brute Force Attacks: A brute force attack entails the systematic checking or guessing of the password for a targeted account. The attacker generally uses sophisticated algorithms to test all possible combinations until the correct one is found. 51% of cybercriminals employ this simple method in their arsenal, due to its convenience and effectiveness in cracking weak cloud security.
Credential Stuffing: Thanks to increasing data breaches over the past several years, there are now immense troves of compromised credentials available for purchase on the dark web — often for pennies apiece. In a credential stuffing attack, a cyber criminal purchases compromised credentials — and then “stuffs” these credentials into login pages of systems, networks and apps until they stumble into a compromised user account. This is also referred to as credential recycling, as it essentially uses the compromised credentials stolen in a previous (typically brute force) attack. Cybersecurity Insiders reports that 34% of organizations suffered from credential stuffing attacks.
Social Engineering (Phishing): Even more common than guessing passwords or buying compromised credentials is using creative social engineering schemes like phishing to steal credentials. IBM reports that phishing was the main method of grabbing credentials in over 41% of organizations — with 62% of those attacks employing spear phishing. And to prove the point, the frequency of phishing attacks grew by 50% towards the end of 2022, with IBM highlighting that successful attacks exposed user credentials and cost an average $4.91 million in damages.
How Can You Prevent Compromised Credentials?
1. Move to Passwordless and “Phishing-Resistant” Auth
The most effective way to reduce the risk of password theft is to stop using passwords as the primary authentication mechanism! Several Identity-as-a-service (IDaaS) vendors are now offering passwordless auth mechanisms that allow users to seamlessly log in to systems with their fingerprint or face recognition. Not only is this a more secure form of authentication it also reduces friction in that it’s an easier way to log in for your end users!
2. Implement a Strong Password Policy
If passwordless is not an option for your organization, another effective way to mitigate the risk of compromised credentials is simply to make the credentials themselves harder to compromise. That means developing and enforcing a strong password policy that requires all users to follow established best practices for creating — and regularly changing — strong passwords, as well as ensuring passwords are not reused across devices, apps, or other accounts.
3. Train Your Users
Compromised credentials and compromised user accounts fall under the umbrella of insider risk, and insider risk is a people problem. One of the most effective ways to solve people’s problems is to talk to your people. Yet a third of workers say their organizations haven’t provided any additional cybersecurity training since the pandemic dramatically changed where, when, and how they work. Providing regular education around best practices for password management and things like how to recognize and avoid phishing schemes can go a long way.
4. Use a Password Manager
One of the easiest ways to help your users maintain strong passwords is to use a password manager. These tools are ubiquitous and increasingly economical and user-friendly. But the two things to remember here are 1) make sure the password manager itself is secure and well-protected against hacking, and 2) make sure users take advantage of the auto-generate feature, available in just about every password manager today, that generates passwords (and remembers them) with much deeper complexity and randomness than a human ever could.
5. Use Multi-Factor Authentication (MFA)
MFA can easily stop an attacker dead in their tracks. They may have compromised credentials, but they almost certainly won’t have access to the secondary (or tertiary) form of identity verification (like a one-time passcode sent to the legitimate user’s mobile device). And organizations are beginning to treat MFA as a necessity, not luxury — Yubico reports that over 24% of enterprises are actively implementing next-gen phishing-resistant MFA that’s in-line with federal directives, while another 32% are considering it.
6. Focus on Privileged Accounts
The ultimate goal of compromised credential attacks is to gain access to valuable data or assets, so it’s not surprising that high-ranking employees and others with privileged access are the biggest targets. The solution is two-fold: First, focus on auditing access privileges. Verizon’s report found that over 80% of employees abuse their level of access — a strong enough case to invoke the principle of least privilege. Second, step up access management protocols for your (now audited) privileged accounts. Microsoft points out that in 88% of ransomware attacks, MFA wasn’t implemented for sensitive and high privilege accounts, while Yubico’s report finds that only IT admins, their teams, and third-parties were sufficiently covered with MFA.
How to Identify Credential Compromise Before Account Damage
Like other forms of insider threat and insider risk, compromised credentials ultimately stem from human-factor issues: poor password hygiene, falling for phishing schemes, etc. The upside is that small changes can make significant impacts on human-factor risks; the downside is that humans will always be imperfect (and cyber criminals are incredibly efficient at exploiting user mistakes) so compromised user accounts can’t be entirely prevented. So, while investing time and budget in prevention is certainly worth it, it’s also critical to invest in strategies for detecting the anomalies and abnormalities that signal compromised accounts — and investigating and responding quickly and effectively.
Make Sure You Have Endpoint Visibility — Remote, in the Cloud, On and Off the Network
The first smoke signals of compromised credentials often come on users’ endpoint devices. So, security teams need to have endpoint visibility — extending to both on and off-network activity, since remote and flexible work models mean users are increasingly working off the VPN. If you haven’t already, automating endpoint inventory management is the first step to gaining that visibility. You should also have visibility into activity on the web and in the cloud since web- and cloud-hosted email is now the norm in many organizations.
Set a Baseline for “Normal” — So You Can Get a Clear Signal of Real Risk
If you can see all user and file activity, including on endpoints, on the web, and in the cloud, it’s much easier to answer the question, “What does normal look like?” This baseline helps you tune out the noise of everyday activity — all the file and data movement that defines the modern collaboration culture — and more quickly and accurately recognize when user behaviors fall outside of the norms. In short, when you start seeing users accessing, moving, renaming, or sharing files in ways or at times that don’t fit the pattern, you’ve got a high-fidelity signal of risk that you know requires an immediate closer look.
Accelerate Your Investigation and Response — Mitigate the Damage
The same deep contextual visibility into all user and file activity is a powerful fuel to accelerate your investigation and response to potentially compromised user accounts. Security teams can rapidly dig into contextual information around file and data movement to identify which user accounts were impacted, which systems or assets were accessed, and what data or files were affected — right down to seeing when and where this valuable data moved. The thorough investigation drives a rapid, right-sized response — whether that’s locking down accounts or devices, taking proactive legal action to protect the company, or referring the incident to authorities for a response. Moreover, the immediate, deep, contextual visibility cuts the time from “detecting compromised credentials” to “neutralizing the threat,” helping to mitigate and minimize the damage from a successfully compromised user account.
Learn more about how Mimecast Incydr can help you detect compromised credentials and protect against data loss from compromised user accounts.
Credential Compromise and How To Stop It | Mimecast
Subscribe to Cyber Resilience Insights for more articles like these
Get all the latest news and cybersecurity industry analysis delivered right to your inbox
