What is account takeover (ATO)?
Account takeover (ATO) is when an attacker gains control of a legitimate user’s account, usually with stolen or reused credentials, a phished MFA code or a hijacked session token, and then acts as that user.
How it works
Credential stuffing tries passwords leaked from one breach against other services. Phishing and infostealer malware capture current passwords and session cookies. Once inside, attackers set up mail forwarding rules, register their own MFA device and move toward money or data.
Signals include sign-ins from new locations, impossible travel, new MFA registrations and new inbox rules.
Why it matters
A taken-over account looks legitimate to most controls. The people whose credentials are exposed, and who hold the most access, are where prevention pays most.
