Attack where criminals gain unauthorised access to a user's account, typically through stolen credentials.
Account Takeover (ATO) occurs when attackers gain access to legitimate user accounts, typically using credentials obtained through phishing, data breaches, or credential stuffing. Once inside, attackers can access sensitive data, send malicious emails from trusted accounts, commit fraud, or move laterally through connected systems. ATO is particularly damaging when it affects accounts with elevated privileges or access to financial systems. Multi-factor authentication is the primary defence against ATO.
Why It Matters
The DSC Perspective:
ATO turns trusted accounts into attack tools. An attacker using a legitimate employee account can bypass many security controls. MFA blocks most ATO attempts even when passwords are compromised.