Reduce risk with Employee Account Takeover Prevention

In an account takeover (ATO) attack, criminals use another person’s login credentials, most often by leveraging reused or similar passwords from previously breached sites, to gain access to existing accounts. Once inside, they make unauthorized transactions, siphon funds, and steal corporate data or personally identifiable information (PII) to use for other purposes, or simply to sell to other attackers on the dark web.

Criminals are typically taking over accounts for profit, pure and simple. It all comes down to money, and how much of it criminals can extract from what they’ve stolen. Contrary to what you may have heard elsewhere, the first step to monetizing stolen credentials is not to sell them on the dark web. That’s actually the last step. What happens first is the highest effort, most profitable activities. When it comes to exploiting work accounts, criminals may try to locate and steal corporate IP or deploy business email compromise scams, which resulted in $2.7B in losses in 2022 alone.

SpyCloud offers seamless integrations with your SIEM, SOAR, IdP, or EDR. To view current list of available integrations or to learn more about custom integrations, visit our integrations page.

Easy-to-remember passwords are also easy for bad actors to guess, making consumers vulnerable to password spraying. Password spraying is a brute force attack where a cybercriminal uses a list of usernames and common passwords to try to gain access to a particular site. Once they get a match, they’ll test that same username and password combination against as many accounts as possible.

There are plenty of news stories about admin passwords that contain the company name. It’s actually a huge problem that we’ve come across too many times to count in analyzing the SpyCloud breach database, and something we recommend customers include on their list of banned passwords.

Credential stuffing makes it possible for criminals to profit from even very old breach data that they buy on the dark web and successfully take over multiple accounts. Credential stuffing tools let criminals test credential pairs against a number of websites to see which additional accounts they can take over; hence why password reuse is so dangerous. Some criminal tools can even test for common password variations, like changing certain letters to numbers (Password vs. P@ssw0rd) or adding numbers or symbols to the end of a word (password123). If a password has been exposed in one data breach, any other account with a variation of the same password is at risk.

Infostealer malware is a form of malicious software used by ransomware operators to slip under the radar and steal information from unsuspecting users’ devices – including credentials, auto-fill data, and OS and device info that enables impersonation without setting off any red flags. This type of malware is typically delivered through phishing emails, malicious websites, and other deceptive tactics. Popular types of infostealers we’ve observed on the darknet recently include RedLine, MetaStealer, Raccoon, and Vidar. SpyCloud Employee ATO Prevention detects when corporate credentials are exposed via an infostealer infection or in a third-party breach.