Why Account Takeovers Are Rising and How Organizations Can Reduce Risk
Summary
A sponsored explainer describes account-takeover methods including MFA fatigue, session-token theft and credential phishing, and recommends continuous verification of device posture. Specops promotes Device Trust as one approach.
Key points
- The article says credential abuse accounted for 22% of breaches in 2025.
- MFA fatigue attacks bombard users with approval requests; attackers can also steal authenticated session tokens to bypass MFA.
- Credential phishing may use reverse proxies, trusted hosting and realistic login pages to evade detection.
- Infostealers can harvest credentials, browser-stored passwords and session cookies from compromised devices.
- The article recommends assessing device posture and session risk continuously, rather than treating successful login as sufficient proof of trust.
- Specops says its Device Trust product checks device posture during sessions and can integrate with identity providers, VPNs and SSO tools.
Article Details
- Topic
- Account-takeover attacks, including MFA fatigue, session-token theft, credential phishing, and continuous device verification.
MITRE ATT&CK
T1539 · Steal Web Session CookieAttackers steal authenticated session tokens or cookies after login to bypass MFA.T1555.003 · Credentials from Web BrowsersInfostealer malware harvests browser-stored passwords from user devices.T1621 · Multi-Factor Authentication Request GenerationAttackers repeatedly trigger MFA approval requests until a user accepts one, a tactic the article calls MFA fatigue or prompt bombing.