How Account Thieves Bypass 2FA and How to Investigate Malware

Summary

Security researcher Leo discusses session-token theft, compromised credentials and malware detection, with practical advice on account recovery, endpoint protection and investigating suspicious Windows activity.

Key points

Leo says stolen session tokens can let attackers impersonate a logged-in user even when two-factor authentication is enabled.
He describes initial access brokers selling compromised credentials and organizational access to other criminals.
For investigating Windows systems, he recommends examining automatic startup entries and services, filtering DNS traffic in Wireshark, and using TCP view to associate connections with processes.
He advises users to inventory important accounts and recovery options, use a password manager, and verify unexpected software links sent through messages.
Leo says attackers can modify Windows Defender exclusions to reduce scanning and recommends evaluating endpoint protection according to individual needs.
He discusses the privacy implications of Windows device identifiers while noting their potential value for identifying cybercriminals.

Article Details

Topics: [02:31] Malware distribution through compromised accounts
[03:51] Investigating suspicious Windows activity with network and system tools
[08:21] Windows device identifiers, privacy and cybercrime investigations
[15:22] Compromised credentials and initial access brokers
[16:56] Account recovery planning and layered defenses
[19:08] Antivirus protection and Windows Defender limitations
[22:19] Password managers, malware delivery and suspicious downloads
[26:44] Account compromise response and session-token theft
[29:39] Malware and vulnerabilities across operating systems