Account takeover is control of a legitimate account by someone other than its owner. Because every subsequent action carries real credentials and real history, it is difficult to distinguish from normal use, which is what makes it valuable to an attacker.
This library records 4 cases.
How the attack runs
- Credentials are obtained, by harvesting, purchase, or reuse from an unrelated breach.
- Second factors are defeated, through code replay, prompt exhaustion, or a help-desk reset.
- Persistence is established, often by registering a new authenticator so the original password can change without losing access.
- The account is used as itself, which is why detection usually depends on behaviour rather than authentication.
Documented cases
- Twitter (2020): employees were phoned by people posing as IT help desk; harvested VPN credentials led to takeover of high-profile accounts.
- Uber (2022): a contractor account taken over through prompt exhaustion plus IT impersonation.
- 0ktapus (2022): nearly 10,000 credentials and 5,441 one-time codes captured across 136 organisations.
- EA (2021): a $10 stolen session cookie gave access to internal Slack, from which support staff were persuaded to grant more.
How it differs from related techniques
Credential harvesting and MFA fatigue are means; takeover is the result. Synthetic identity creates a new fraudulent account rather than seizing a real one.
The control that would have stopped it
- Phishing-resistant MFA, which removes replayable codes and approvable prompts.
- Treat session tokens as credentials. EA was breached with a cookie, not a password, so token lifetime and binding matter.
- Alert on authenticator enrolment, a reliable early signal of persistence.
- Behavioural monitoring, since valid credentials will pass authentication checks by definition.
- Verify identity before help-desk resets, which is where Twitter and Uber were reachable.
Social Engineering Examples