How are user credentials stolen and used by threat actors?
Summary: Cisco Talos reports that valid accounts were the second-most common MITRE ATT&CK technique in its 2023 threat telemetry, and 26% of its incident response engagements last year involved valid account use. In Q4 2023, compromised credentials on valid accounts tied with public-facing web application exploits as the top initial access vector, while 36% of malicious tooling focused on accessing and collecting credentials.
Key Takeaway: Oort data cited by Talos found 40% of enterprise customers have no MFA or weak MFA such as clear-text SMS, and dormant accounts make up nearly a quarter of the average company's accounts and are targeted over 500 times per month.
Read the original at Cisco Talos ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026