Account Takeover (ATO)

Account takeover begins with the attacker obtaining valid credentials. The most common source is a data breach: username and password pairs leaked from one service are replayed against many others, exploiting the fact that people reuse passwords. Attackers also harvest credentials through phishing pages, infostealer malware that scrapes saved browser passwords, and social-engineering the account recovery process.

Armed with credentials, the attacker automates login attempts at scale. Credential-stuffing tools cycle through millions of pairs, often distributed across large pools of residential proxies so that no single IP address shows an abnormal login rate. When a login succeeds, the session is either used immediately or the working credential is sold on. To defeat multi-factor authentication, attackers may intercept one-time codes through SIM swap, real-time phishing proxies, or MFA-fatigue prompt bombing.

Once inside, the attacker moves quickly to monetize access before the real owner notices. Typical actions include draining stored balances and loyalty points, changing the registered email and password to lock the owner out, adding new payment payees, placing orders to a drop address, or using the trusted account as a springboard for further phishing. The compromised account's history and reputation make these actions look legitimate to downstream systems.

Sophisticated ATO campaigns try to mimic the victim's normal behavior to stay below detection thresholds, matching the usual device type, approximate location, and login timing. This is why static rules alone struggle: the credentials are correct and the individual actions can each look plausible.