Cyberattacks increasingly target identity, exploiting stolen credentials and session tokens. Defenses must secure every link in the identity chain, from creation to recovery.
Identity as the main target
According to the Sophos Active Adversary Report 2026, 67 percent of the incidents handled by its teams originate from an attack targeting identity. This indicates that cybercriminals are increasingly focusing on stealing and misusing identity credentials rather than traditional methods of infiltration.Rise of information-stealing software
The industrialization of information-stealing software, known as infostealers, and the rise of access brokers who sell access to these tools, contribute to this shift. Attackers are using advanced social engineering techniques powered by artificial intelligence to manipulate users and gain access to systems.The multi-step attack process
An information thief typically retrieves a password and a session cookie from a workstation. If a second factor of authentication is not in place, the intruder can open a session. If this fails, they may contact support to reset the account, showing that the attack is multi-step and has multiple opportunities for interception.The role of identifier/password pairs
A correct password proves knowledge of the system but not an individual's identity. According to the 2025 Identity Threat Landscape Report from Recorded Future, nearly 2 billion identifier exposures were recorded in 2025 from lists of identifier/password pairs associated with malicious software, highlighting the scale of the issue.Credential stuffing and password spraying
Two techniques benefit from the availability of stolen credentials: credential stuffing, which mass-replays leaked pairs on other services, and password spraying, which tests a few common passwords on many accounts to avoid triggering lock thresholds. These methods exploit the widespread exposure of identifiers.The impact of valid account usage
The Microsoft Digital Defense Report 2026 shows that 20 percent of initial accesses observed by Microsoft Defender Experts involved valid accounts, where attackers used stolen passwords or session tokens. This highlights the growing threat of compromised credentials being used for unauthorized access.The limitations of password security
The advice to choose a robust password reaches its limit when the password is already present in a data leak. The real solution lies in verifying that a password is not in known compromised databases and strengthening identity proof during the initial setup.The role of MFA
Multi-factor authentication (MFA) is a recommended security measure but must be properly configured. The Sophos report notes that 59 percent of cases handled involved absent or insufficiently configured MFA, indicating that MFA alone is not enough to prevent breaches.Session tokens as targets
Once a user is authenticated, a session token is used to maintain access without re-entering credentials. This token has become a key target for attackers, who use techniques like man-in-the-middle attacks or infostealers to capture and reuse these tokens to bypass MFA.The evolving threat of social engineering
Social engineering outside of phishing has grown significantly, from 3 percent in 2021 to 11 percent in 2025, according to the Global Incident Response Report 2026 from Unit 42 of Palo Alto Networks. Voice cloning by AI further complicates identity verification, making it harder to detect deceptive attempts.Access recovery as a new front line
Resetting passwords or unlocking accounts is a common process that can be exploited. Attackers may impersonate employees to trick support teams into granting access. This highlights the need for robust verification processes during access recovery.Combining defense strategies
To counter these threats, a combination of strategies is needed. This includes self-service password reset with strong verification and protocols that allow support teams to confirm a caller's identity with verifiable proof rather than simple knowledge-based questions.Continuous identity security
Cybersecurity Month 2026 emphasizes the importance of continuous identity security, from the creation of identifiers to access recovery. The theme "Secure Our World" underscores the need to ensure that no link in the identity chain is left unprotected.
