Account Compromise

1. Introduction to Account Compromise

Account compromise occurs when an unauthorized person gains
control of, or unauthorized access to, an account belonging to another user
or organization.

A compromised account may provide access to email, websites, databases,
cloud platforms, financial systems, social platforms, internal applications
or administrative services.

2. Why Account Compromise Matters

A compromised account can become an entry point into other systems.

The impact depends on the privileges assigned to the account and the systems
that it can access.

A standard user account may expose personal or business information, while a
privileged account may provide access to critical infrastructure.

3. Common Causes of Account Compromise

• Phishing
• Weak passwords
• Password reuse
• Credential stuffing
• Password spraying
• Malware
• Exposed credentials
• Insecure password-reset procedures
• Stolen authentication sessions
• Compromised devices
• Misconfigured applications
• Excessive account privileges

4. Credential Theft

Credential theft occurs when authentication information is obtained by an
unauthorized party.

Credentials may include usernames, passwords, authentication codes, access
tokens or other authentication information.

Credential theft can occur through phishing, malware, exposed databases or
other security incidents.

5. Phishing and Account Compromise

Phishing is one common way attackers attempt to obtain authentication
information.

A user may be directed to a fraudulent login page or persuaded to disclose
information through a deceptive message.

Security awareness and strong authentication controls can reduce this risk.

6. Password Reuse

Password reuse creates additional risk because a password compromised at one
service may be attempted against another service.

Users should use unique passwords for important accounts.

Password managers can make unique passwords easier to maintain.

7. Credential Stuffing

Credential stuffing involves attempting previously exposed username and
password combinations against other services.

This technique depends heavily on password reuse.

Organizations can reduce related risk with MFA, compromised-password
detection and authentication monitoring.

8. Password Spraying

Password spraying uses a small number of common passwords against multiple
accounts.

This differs from traditional brute force, which may repeatedly target one
account with many possible passwords.

Authentication monitoring can help security teams identify suspicious
patterns.

9. Malware and Account Compromise

Malware may contribute to account compromise by stealing credentials or
interfering with authentication activity.

The appropriate defensive response may include isolating affected devices,
reviewing security logs and resetting potentially exposed credentials.

10. Session Compromise

Web applications often create a session after successful authentication.

The session allows the application to recognize the authenticated user across
multiple requests.

If an attacker obtains a valid session identifier or token, they may
potentially access the application as the victim until the session is
invalidated or expires.

11. Authentication Tokens

Modern applications may use tokens for authentication and authorization.

Examples include session tokens, API tokens and other application-specific
credentials.

Tokens should be protected and should have appropriate lifetimes,
permissions and revocation mechanisms.

12. Account Takeover

Account takeover occurs when an attacker gains control over
an account and uses it as though they were the legitimate account owner.

The attacker may change account settings, access information, impersonate
the user or attempt to access other systems.

13. Signs of a Compromised Account

Possible indicators include:

• Unexpected successful logins
• Logins from unfamiliar locations
• Unexpected password-reset messages
• Security settings changing without authorization
• Unknown MFA devices
• Unknown recovery email addresses or phone numbers
• Unexpected sent messages
• New forwarding rules in email
• Unexpected API tokens
• Unexpected account activity
• Access to resources the user did not request

A single indicator does not necessarily prove compromise. Investigators
should examine the wider context.

14. Impossible Travel

Security systems may flag authentication events that appear to originate from
geographically distant locations within an unrealistic time period.

This is sometimes called an impossible-travel indicator.

However, VPNs, mobile networks, proxies and other legitimate technologies can
produce misleading location information.

15. Unexpected MFA Events

Unexpected MFA approval requests can indicate that someone knows or is
attempting to use a user’s password.

Users should not approve authentication requests they did not initiate.

Unexpected authentication prompts should be reported according to the
organization’s security procedures.

16. Email Account Compromise

Email accounts are particularly valuable because they are often connected to
password resets and communication with other users.

A compromised email account may be used to:

• Read sensitive messages
• Send fraudulent messages
• Change recovery information
• Create forwarding rules
• Attempt password resets for other services
• Impersonate the legitimate user

17. Account Compromise and Privilege

The impact of compromise is closely related to account privileges.

An account with administrative privileges may provide access to more systems
than a standard user account.

This is why organizations should follow the principle of
least privilege.

18. Least Privilege

Least privilege means giving a user, application or service only the access
required to perform its legitimate responsibilities.

Reducing unnecessary privileges can reduce the potential impact of an
account compromise.

19. Privileged Accounts

Privileged accounts should receive additional protection because their
compromise may have a larger impact.

Defensive measures may include:

• MFA
• Separate administrative accounts
• Strong access controls
• Privileged-access monitoring
• Shorter session lifetimes where appropriate
• Regular access reviews

20. Immediate Containment

When account compromise is suspected, the immediate response should focus on
limiting further unauthorized access.

Depending on the environment, containment may include:

• Disabling the account temporarily
• Resetting the password
• Revoking active sessions
• Revoking exposed tokens
• Removing unauthorized MFA devices
• Reviewing recovery settings
• Isolating a compromised endpoint

21. Password Reset

A password reset may be appropriate when a password is believed to have been
exposed.

The new password should be unique and should not have been used on other
services.

Organizations should follow their incident-response procedures rather than
changing credentials blindly without understanding the wider compromise.

22. Session Revocation

Changing a password does not necessarily address every existing session.

Applications should provide mechanisms for revoking active sessions when
compromise is suspected.

This can help prevent an attacker from continuing to use an already
authenticated session.

23. Token Revocation

API tokens and other persistent credentials may need to be revoked when they
are believed to have been exposed.

Organizations should maintain an inventory of important tokens and understand
how they can be disabled or rotated.

24. MFA After Compromise

MFA should be enabled for sensitive accounts where supported.

After compromise, security teams should verify that the attacker has not
added an unauthorized MFA method.

Simply resetting a password may not be enough if an unauthorized
authentication method remains attached to the account.

25. Account Recovery

Account recovery procedures should provide a secure method for legitimate
users to regain access without creating an easy path for attackers.

Recovery processes should verify identity appropriately and protect recovery
information.

26. Authentication Logs

Authentication logs can provide valuable evidence during an account
compromise investigation.

Security teams may examine:

• Login time
• Source IP address
• Authentication method
• Success or failure
• User agent or device information
• MFA events
• Password-reset events
• Session creation
• Token creation
• Privilege changes

27. Review Account Activity

After suspected compromise, investigators should review what the account did
during the relevant period.

Questions may include:

• Which systems were accessed?
• Which files were viewed or changed?
• Were messages sent?
• Were new credentials created?
• Were permissions changed?
• Were suspicious applications authorized?

28. OAuth and Application Access

Modern applications may allow users to authorize third-party applications to
access account information.

An investigation may therefore need to review connected applications and
revoke unauthorized permissions.

29. Account Compromise Response Process

1. Identify the suspected account.
2. Confirm the indicators where possible.
3. Contain further access.
4. Reset exposed credentials.
5. Revoke active sessions and tokens.
6. Review MFA and recovery settings.
7. Investigate account activity.
8. Check related systems and accounts.
9. Restore secure access.
10. Document the incident.

30. Do Not Destroy Evidence

Incident responders should be careful not to destroy useful evidence while
attempting to contain an incident.

Organizations should follow their established incident-response procedures
for preserving logs and other relevant evidence.

31. Account Compromise and Business Email Compromise

A compromised business email account may be abused to impersonate an employee
or request actions from other people.

Organizations should verify sensitive requests through trusted communication
channels, especially requests involving money, credentials or confidential
information.

32. Monitoring for Account Compromise

Security monitoring can identify unusual account behavior.

Examples include:

• New login locations
• Unusual login times
• Repeated failed authentication
• Unexpected successful authentication
• New devices
• Unexpected MFA changes
• New forwarding rules
• Unusual downloads
• Unexpected privilege changes

33. Account Risk Example

A security team may represent account activity using structured records.
For example:

$account = array(
	'user'              => 'student@example.test',
	'failed_logins'     => 12,
	'unusual_location'  => true,
	'mfa_changed'       => true,
	'password_reset'    => true,
);

$risk_score = 0;

if ( $account['failed_logins'] >= 5 ) {
	$risk_score += 25;
}

if ( $account['unusual_location'] ) {
	$risk_score += 25;
}

if ( $account['mfa_changed'] ) {
	$risk_score += 30;
}

if ( $account['password_reset'] ) {
	$risk_score += 20;
}

echo 'Synthetic account risk score: ' . $risk_score;

This example uses completely synthetic information. A production security
system would require a much more careful risk model and additional context.

34. Why Risk Scores Need Context

Automated risk scoring should not automatically treat every unusual event as
malicious.

For example, a legitimate employee may travel, use a new device or reset a
password.

Security teams should investigate multiple indicators before reaching a
conclusion.

35. Preventing Account Compromise

• Use unique passwords.
• Use MFA for important accounts.
• Use password managers where appropriate.
• Keep devices and applications updated.
• Protect recovery information.
• Review account permissions.
• Use least privilege.
• Monitor authentication activity.
• Remove unnecessary accounts.
• Revoke access promptly during offboarding.

36. Account Offboarding

When an employee or contractor leaves an organization, access should be
removed according to an established offboarding process.

This may include disabling accounts, revoking sessions, removing application
access and reviewing privileged credentials.

37. Security Awareness

Users play an important role in protecting accounts.

They should know how to recognize suspicious messages, unexpected MFA
requests, password-reset notifications and other warning signs.

38. Authorized Classroom Exercise

Create a synthetic account-compromise investigation using fictional users
and events.

1. Create three fictional user accounts.
2. Give each account several synthetic login events.
3. Mark some events as normal.
4. Mark other events as unusual.
5. Identify possible compromise indicators.
6. Design a containment plan.
7. Identify which logs should be reviewed.
8. Document the investigation.

39. Account Compromise Investigation Checklist

40. Review Questions

1. What is account compromise?
2. What are common causes of account compromise?
3. How can phishing contribute to account compromise?
4. What is password reuse?
5. What is credential stuffing?
6. What is session compromise?
7. What is account takeover?
8. List five indicators of a potentially compromised account.
9. Why are privileged accounts particularly important to protect?
10. What is least privilege?
11. Why should active sessions sometimes be revoked after compromise?
12. Why should exposed tokens be revoked?
13. What should investigators review in authentication logs?
14. Why should MFA settings be checked after suspected compromise?
15. Why is account recovery security important?
16. How can organizations reduce account-compromise risk?
17. Why should security investigations use context instead of relying on a single indicator?

41. Key Takeaways

• Account compromise occurs when unauthorized parties gain access to or control an account.
• Passwords are only one part of account security.
• Phishing, password reuse, malware and exposed credentials can contribute to compromise.
• Sessions and authentication tokens also require protection.
• Unexpected MFA activity can be an important warning sign.
• Privileged accounts require additional protection.
• Least privilege can reduce the impact of compromise.
• Password resets may need to be combined with session and token revocation.
• Recovery and MFA settings should be reviewed after suspected compromise.
• Authentication logs are valuable during investigations.
• Connected applications and third-party permissions may need review.
• Incident responders should preserve relevant evidence.
• Security risk indicators should be interpreted in context.
• Only authorized systems and synthetic credentials should be used in classroom exercises.

42. Conclusion

Account compromise is a major cybersecurity concern because a single
compromised identity can provide access to many resources.

Effective protection requires strong authentication, unique credentials,
MFA, least privilege, secure recovery procedures, session protection and
continuous monitoring.

When compromise is suspected, organizations should contain the account,
secure authentication methods, investigate activity and document the
incident according to their response procedures.

The next lesson will examine one of the most damaging forms of malicious
software and extortion:
Ransomware.