Account takeover detection shows why identity telemetry still matters

At a glance

What this is: This is an account takeover case study showing how coordinated credential abuse was detected through behavioural correlation across location, ASN, and session signals.

Why it matters: It matters because IAM, PAM, and identity monitoring teams need detection logic that can distinguish legitimate travel from distributed credential attacks across human and service identities.

By the numbers:

• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases.

👉 Read Exaforce's account takeover detection analysis for the full incident timeline

Context

Account takeover is an identity problem before it becomes a fraud or endpoint problem. When attackers can test credentials from distributed infrastructure, a simple failed-login count no longer tells defenders whether they are seeing routine noise or a coordinated attempt to obtain valid access.

In this case, the detection challenge sits squarely in human IAM telemetry and session governance. The article shows that impossible travel, ASN mismatch, and repeated policy evaluations provided the context needed to separate targeted credential abuse from ordinary authentication activity, which is a familiar failure mode in mature identity programmes.

The attack pattern is typical of modern identity abuse rather than an edge case. Persistent probing, infrastructure rotation, and eventual successful authentication are now standard characteristics of account takeover campaigns, especially where access is protected only by passwords and weak anomaly review.

Key questions

Q: How should security teams detect account takeovers after login succeeds?

A: Security teams should monitor the session after authentication, not just the login event. The best detections combine identity, email, and application telemetry over time so weak anomalies can be evaluated as one behavioural sequence. That approach catches trusted-account misuse that single-product tools often miss.

Q: Why are valid credentials so dangerous in identity attacks?

A: Valid credentials are dangerous because they inherit existing trust, roles, and access paths, which makes them harder to distinguish from normal activity. Attackers prefer them because they reduce noise and can bypass many exploit-based detections. In NHI environments, long-lived tokens and service accounts create the same problem at machine scale.

Q: What do teams get wrong about impossible travel alerts?

A: They treat impossible travel as a yes-or-no decision instead of one signal in a larger behavioural pattern. In practice, travel alerts are useful only when combined with ASN anomalies, account history, and policy evaluation outcomes. Without that context, legitimate user movement and attacker infrastructure both look equally suspicious or equally safe.

Q: Who is accountable when account takeover succeeds despite verification controls?

A: Accountability sits across identity, fraud, and operations, because takeover usually exploits a gap between onboarding, monitoring, and transaction decisioning. If a business relies on one team to verify the customer and another to catch abuse later, the attacker can move through the handoff. Governance should assign ownership across the full account lifecycle.

Technical breakdown

Why impossible travel alone is not enough

Impossible travel flags a session when two authentications appear too far apart geographically to be physically plausible. The problem is that the signal is often noisy in distributed workforces, VPN use, and roaming users, so it cannot stand alone as a control. In this case, the stronger signal came from combining geography with ASN history, device context, and repeated policy evaluations. That turns isolated login events into a behavioural pattern that indicates coordinated credential abuse rather than a one-off anomaly.

Practical implication: treat impossible travel as a correlation input, not a standalone verdict.

How ASN anomalies expose rotating attacker infrastructure

ASN, or autonomous system number, identifies the network provider behind an IP address. Attackers often rotate infrastructure across consumer ISPs, hosting providers, and anonymisation services to avoid simple IP blocklists. ASN-aware detection adds a second layer by asking whether the network path matches the user's normal access pattern. In the incident described, many successful and failed logins came from ASNs that did not align with the account history, which increased confidence that the activity was malicious.

Practical implication: add ASN history to identity detection logic for high-value accounts.

Why session stitching matters after valid credentials are obtained

Once an attacker has valid credentials, the challenge shifts from preventing login to understanding what the authenticated session did over time. Session stitching reconstructs activity across sign-ins, policy checks, and successive actions so analysts can see progression rather than isolated events. That is especially important when the adversary uses many IPs, short bursts, or repeated login attempts over days. Without timeline stitching, the incident looks like scattered noise and the privilege abuse remains hidden until after impact.

Practical implication: preserve and correlate sign-in and session events long enough to reconstruct the full attack path.

Threat narrative

Attacker objective: The attacker aimed to obtain valid account access that could be reused for persistent identity abuse inside the customer's environment.

1. Entry began with brute-force login attempts against SaaS authentication portals, spread across many countries and IP ranges to find a weak account.
2. Escalation occurred when the attacker obtained valid credentials and used rotating infrastructure to complete multiple successful authentications from anomalous ASNs and locations.
3. Impact followed as the adversary maintained access long enough to require forced logout, password reset, and MFA enrolment to stop further misuse.

Breaches seen in the wild

• MongoBleed breach — MongoBleed exposed secrets across 87K MongoDB servers.
• IOS app secrets leakage report — iOS apps leaking hardcoded secrets and credentials endangering user privacy.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity telemetry is now a primary control surface, not just a detection layer. This incident shows that account takeover does not announce itself through a single obvious event. It emerges through weak signals that only become meaningful when geolocation, ASN history, and session behaviour are stitched together. The practitioner conclusion is straightforward: identity telemetry has to be treated as an operational control surface, not an after-action investigation tool.

Account takeover is increasingly a correlation problem, not a login problem. The attack persisted across weeks and dozens of networks, which means the attacker was optimising for persistence and ambiguity rather than speed. That makes legacy alerting, based on isolated failed logins or one-off impossible travel alerts, too thin to carry the governance burden. The practitioner conclusion is that identity defence must be built around behaviour over time.

Ephemeral access assumptions fail when attackers can blend into normal authentication patterns. The control gap exposed here is not the absence of passwords alone, but the assumption that a valid login is evidence of a legitimate user. That assumption breaks when credential theft, infrastructure rotation, and policy-evasion tactics converge. The practitioner conclusion is that identity governance has to assess authenticity and continuity, not just authentication success.

Named concept: identity blast radius. Once the attacker obtained valid credentials, the risk was no longer limited to the entry account. The blast radius expanded through active sessions, repeated authentications, and the possibility of admin-level reach if the compromised identity had elevated privileges. The practitioner conclusion is that account compromise should be measured by the reach of the session, not the existence of the password alone.

From our research:

• The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
• Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
• That behaviour gap matters because secret exposure and credential reuse create the same downstream identity-abuse conditions that make account takeover campaigns hard to stop.
• From our research: Explore NHI Lifecycle Management Guide for the provisioning, rotation, and offboarding controls that reduce standing identity risk.

What this signals

Security teams should expect account takeover detections to depend more on correlation quality than on raw alert volume. Identity blast radius: when a credential is valid, the practical question becomes how far the session can reach before containment, which is why session stitching and account scoping matter more than isolated login alerts.

The programme implication is that identity operations, SOC, and IAM ownership need shared telemetry language. If impossible travel, ASN mismatch, and session history are not evaluated together, defenders will keep seeing fragments of the same attack instead of one coordinated compromise. That slows containment and weakens audit evidence.

For practitioners

• Correlate login events across geography and ASN Join geolocation, ASN history, and account-specific behaviour into one detection view so repeated attempts from inconsistent networks can be scored as a single campaign. Keep the threshold low enough to surface distributed probing before the first successful login.
• Prioritise high-value identities for session reconstruction Build timeline stitching for admin accounts, shared accounts, and identities tied to sensitive operations so analysts can reconstruct activity after valid credentials are used. Preserve the sign-in, policy, and session trail long enough to support containment and audit review.
• Use MFA as a containment control, not just a prevention control When a takeover is suspected, force logout active sessions, reset credentials, and enrol the account in MFA immediately so the attacker cannot continue using the same access path. This response is only effective if session state is visible and controllable.
• Tune impossible travel with network context Combine impossible travel with ASN mismatch, VPN allowlists, and historical access patterns so legitimate mobility does not drown out real attacker movement. A single impossible travel rule is too brittle for modern identity operations.

Key takeaways

• Account takeover campaigns now succeed by blending into ordinary authentication patterns, which makes identity correlation the decisive control.
• The incident shows that geography, ASN, and session evidence can expose persistent credential abuse even when individual logins appear routine.
• Teams that can reconstruct identity activity quickly are better positioned to contain compromise before valid credentials turn into broader session abuse.

Key terms

• Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
• Impossible Travel: Impossible travel is a detection signal that flags authentications that occur too far apart geographically to be physically plausible. It is useful for spotting remote credential abuse, but it must be combined with network, device, and account history to avoid false positives and missed intrusions.
• ASN Anomaly: An ASN anomaly occurs when an authentication originates from a network provider that does not match the account's normal access pattern. It helps defenders distinguish genuine users from rotating attacker infrastructure, especially when adversaries spread login attempts across many countries and hosting providers.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

What's in the full article

Exaforce's full blog post covers the operational detail this post intentionally leaves for the source:

• The incident timeline with the specific dates, IP clusters, and policy evaluations that supported triage.
• The exact detection sequence across impossible travel, ASN anomaly, and success-failure ratios.
• The remediation actions taken after compromise, including session termination, password reset, and MFA enrolment.
• The analyst-style breakdown of how the platform packaged evidence for export and audit use.

👉 The full Exaforce post covers the attack progression, behavioural detections, and containment actions in detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.