Account Takeover: Definition and Explanation

What is an Account Takeover?

Account takeover (ATO) allows the attacker to gain access to the data and privileges associated with the compromised account. Often, the hacker will use an account breach to obtain access to additional accounts. This lateral movement to related accounts can be difficult to detect.

The hacker usually gains access to a user’s account through social engineering exploits. This could be a phishing exploit where an account owner is tricked into disclosing login credentials with a deceptive email or website form or online form. Or the attacker could employ baiting where the victim is enticed with a reward to review account details.

Both private and corporate accounts can be targets of ATO attacks, however often for very different reasons.

‍

Personal Account Takeovers

Personal ATOs may be carried out to gain access to a user’s financial accounts, resulting in fraudulent transactions, or to gain access to a target organization’s network.

ATO can be the perfect launching point for an attack on a private or government organization. Cybercriminals seek the most vulnerable entry points to the target organization and strategize their next move from there.

‍

How Do Account Takeovers Happen?

In the past, account takeovers typically occurred when a hacker would gain access to the account by guessing the credentials, using brute force to obtain the credentials, or breaking into an account the intruder has previously gotten into. Usually, this form of account takeover could be prevented by multi factor authentication (MFA). However, MFA is no longer enough to prevent modern day account takeovers. Hijackers now smartly trick account owners into downloading a software, clicking a sinister link, and more. This allows hijackers to hack the account and gain access without ever needing the user’s credentials. These modern account takeovers are harder to correct or prevent because the hacker has access to the network the account is on, not just the user credentials.

‍

Corporate Account Takeovers

Corporate Account Takeover (CATO) is a type of ATO where the targeted account belongs to a business. The attacker may use the compromised account to authorize fraudulent financial transactions, add fake employees to payroll or exfiltrate sensitive data. Cybercriminals often obtain credentials to corporate accounts by targeting employees with phishing attacks, phone scams or malware.

‍

Common Questions

What are some account takeover prevention best practices?

Private users can prevent ATO by implementing the following precautions:

• Use multi-factor authentication when possible
• Monitor user behavior on accounts within the network that have already been logged into (not just monitoring unusual login attempts)
• Educate users to identify suspicious emails, links, or downloads
• Create unique, strong passwords for every account
• Use a password manager to keep track of login credentials
• Install an antivirus software on all devices
• Keep devices up-to-date with the latest versions of applications, patches and updates

‍

How can you secure your business data against corporate account takeovers?

Multi-factor authentication (MFA) was once the most common way to secure data and prevent account takeovers. However, MFA is no longer sufficient to prevent CATO and must be supplemented with cybersecurity software to hunt and respond to account takeover threats.

‍

Account Takeover Prevention with Vectra

Currently, account takeovers have become the largest security threat vector in the cloud. In fact, 30% of organizations suffer account takeovers every month, even with multi-factor authentication in place. Vectra’s AI powered network detection and response platform, Cognito, finds and stops cyber threats inside the cloud to protect your network from sinister attackers.