How should security teams detect account takeover campaigns that use proxies and stolen credentials?

They should correlate login telemetry across users, time windows, and infrastructure so the same IP blocks, browser traits, or VPNs can be linked to a wider campaign. Single-event scoring is not enough when each login looks plausible on its own. Behavioural correlation turns weak signals into a defensible case for response.

Why This Matters for Security Teams

Proxy-backed account takeover rarely trips a single high-risk alert because each login can look routine in isolation. Attackers spread attempts across residential proxies, VPN egress points, and stolen browser cookies to blend into normal traffic patterns, which makes simple IP blocklists or password-failure thresholds easy to evade. The real problem is campaign structure: one credential, many infrastructure pivots, and repeated low-friction success attempts.

That is why correlation matters more than any single signal. Security teams need to connect authentication events by shared infrastructure, device traits, and time proximity, then compare those clusters against user baselines and known abuse patterns. This approach aligns with the account takeover patterns documented in the 52 NHI Breaches Analysis and with control guidance in the OWASP Non-Human Identity Top 10, where weak lifecycle and monitoring practices repeatedly turn into exploitable access paths.

The operational lesson is blunt: attackers do not need a perfect login, only a plausible one repeated at scale. In practice, many security teams encounter the campaign only after token abuse, mailbox access, or lateral movement has already started, rather than through intentional detection of the first suspicious sign-in.

How It Works in Practice

Detection works best when telemetry is normalized into a campaign view instead of a per-event score. A useful model joins authentication logs, device fingerprints, ASN and proxy intelligence, session duration, geo-velocity, and downstream actions such as MFA resets or unusual API calls. Teams then look for clusters where the same infrastructure repeatedly appears across multiple accounts, or where one account moves through several proxy exits in ways that do not match the user’s usual pattern.

Practically, this means building correlation rules that answer questions such as: did several unrelated users authenticate from the same proxy range within a short window, did the browser traits remain identical across different identities, and did successful logins quickly lead to mailbox rules, password changes, or new recovery methods? The NIST Cybersecurity Framework 2.0 supports this kind of detection-oriented monitoring, while the State of Non-Human Identity Security shows why monitoring and logging gaps remain a major cause of compromise.

• Correlate IP, ASN, device, and browser fingerprints across users, not just within one account.
• Score sequences, such as login, MFA change, and privilege escalation, as a single campaign chain.
• Flag high-velocity reuse of the same proxy exit or residential subnet across many identities.
• Compare current sign-ins to user baselines for device drift, location drift, and login timing drift.

Teams should also enrich detections with identity assurance data from the authentication layer, especially where session hijack or cookie replay is possible. These controls tend to break down in consumer-scale environments with massive NAT sharing and heavy use of privacy VPNs because benign traffic can resemble campaign reuse.

Common Variations and Edge Cases

Tighter correlation often increases investigation overhead, requiring organisations to balance better campaign visibility against false positives from shared networks and legitimate remote work. That tradeoff is real, especially when contractors, call centres, or globally distributed staff appear to log in from the same commercial VPN providers that attackers also abuse.

Current guidance suggests using layered context rather than a single proxy indicator. For example, a shared IP range is weak evidence on its own, but shared IP plus identical browser traits plus a suspicious post-login action is far more defensible. The NIST SP 800-63 Digital Identity Guidelines are useful for thinking about assurance, but there is no universal standard for proxy-campaign scoring yet, so teams should tune thresholds to their own user population and risk tolerance.

Two NHIMG references are especially useful here: the Guide to the Secret Sprawl Challenge for understanding how compromised credentials amplify access paths, and the NHI Lifecycle Management Guide for reducing the persistence of stolen secrets and session material. In practice, the hardest edge case is when attackers use fresh proxies per attempt and stolen session cookies, because the network trail goes quiet while the identity trail remains only barely abnormal.

Related resources from NHI Mgmt Group

• How should security teams respond when an account takeover is confirmed but exposure is unknown?
• How should security teams defend against TOAD phishing campaigns that use phone callbacks?
• How should security teams detect account takeovers after login succeeds?
• How should security teams detect phishing that does not use malicious payloads?