[Video] The TTP Ep 21: When Attackers Become Trusted Users
Summary: Cisco Talos' Threat Perspective episode 21 examines how attackers use identity to gain, extend, and maintain access, drawing on the 2025 Talos Year in Review. The episode covers targeting of identity systems and MFA workflows, persistent high-trust access, internal phishing for lateral movement, potential exploitation of over-permissioned AI agents, and attackers blending into normal user behavior.
What you should know: Talos reports that in 2025 attackers increasingly targeted weaknesses in MFA workflows and launched phishing lures from valid, compromised credentials on trusted accounts - meaning the trusted account itself is now the attack path defenders must detect.
Read the original at Cisco Talos ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026