Compromised credentials now bypass many authentication controls

At a glance

What this is: This is an analysis of how stolen credentials evade traditional authentication checks and what signal groups help detect abuse after login succeeds.

Why it matters: It matters because IAM, PAM, and NHI programmes must move beyond password-centric controls and detect legitimate-looking abuse across sessions, tokens, and service accounts.

By the numbers:

• Stolen credentials were involved in 22% of breaches in 2025.
• Those breaches took an average of about 292 days to identify and contain.
• 22 seconds.
• Internally detected breaches have a lifecycle 61 days shorter and cost roughly $1 million less per breach compared to attacker-disclosed events.

👉 Read Panther’s analysis of compromised credential detection and response steps

Context

Compromised credentials are a governance problem, not just a login problem. In cloud-native environments, stolen OAuth tokens, session cookies, API keys, and service account credentials can authenticate successfully while bypassing the normal signals that identity teams rely on to prove access was legitimate.

This is where NHI, IAM, and PAM intersect. Once an attacker has a valid credential artifact, the question is no longer whether authentication succeeded. It is whether post-authentication behaviour, session state, and privilege use still fit the expected identity model.

The article is typical of modern credential abuse analysis: the technical weakness is not a single control failure, but the gap between issued authentication material and the actual user intent behind its use.

Key questions

Q: How should security teams respond when attackers steal a valid session instead of a password?

A: They should treat the session as compromised, not just the password. Contain the affected account, revoke tokens and cookies, inspect downstream SaaS and email activity, and look for reuse across other systems. Session theft often bypasses MFA entirely, so response has to focus on inherited trust, not the original login event.

Q: Why do compromised credentials often bypass MFA controls?

A: Because many attacks steal the artifact issued after MFA, not the password itself. If an attacker reuses a session cookie, OAuth token, or refresh token, the login appears already authenticated. MFA was satisfied earlier, so the control did its job but did not protect the downstream artifact from replay.

Q: What signals indicate that a service account has been abused?

A: Interactive logons, unfamiliar source hosts, atypical time-of-day use, and sudden access bursts are the most useful signals. A service account should have a narrow behavioural pattern. When it starts acting like a person, or begins touching mailbox or cloud resources it never used before, treat that as compromise until proven otherwise.

Q: Who is accountable when stolen tokens are used to change cloud settings?

A: Accountability sits with the team that owns identity policy, privileged access design, and incident response together. If token revocation, admin separation, and tenant-change monitoring are split across teams, attackers can move faster than the response model. Governance must cover the whole session lifecycle.

Technical breakdown

Why valid accounts defeat normal detection

Credential abuse often hides inside legitimate authentication events. When a stolen OAuth token, session cookie, or API key is replayed, the identity provider sees a successful login or session continuation rather than a failed attempt. That is why MITRE ATT&CK classifies this pattern as valid accounts. MFA may already have been satisfied earlier in the session, so the attacker inherits trust from an issued artifact instead of triggering a new challenge. In practice, the detection problem starts after authentication, where static login thresholds no longer describe the real risk.

Practical implication: monitor post-authentication activity, not just failed sign-ins or MFA prompts.

How infostealers and AiTM kits create session theft

Infostealers harvest browser-saved passwords, cookies, TOTP seeds, and cloud credentials from endpoints, while adversary-in-the-middle phishing captures the session artifact after the user completes MFA. Both methods produce access material that behaves like an already trusted session. That is why password resets alone are insufficient if the session cookie, refresh token, or cloud key remains active. The issue is not only identity theft. It is trust transfer from the real user to a replayable artifact that can be used elsewhere.

Practical implication: revoke all active session artifacts, not only passwords, when compromise is suspected.

Why cross-log correlation matters for credential abuse

A single event rarely proves compromise. The stronger signal is a sequence that connects identity logs, cloud activity, and SaaS actions: new device fingerprint, unusual mailbox access, forwarding rule creation, or cloud key creation outside normal change windows. Normalization is essential because field names and schemas differ across platforms. Without correlation, each event can look benign on its own. With correlation, the sequence reveals persistence, privilege expansion, or exfiltration activity that static per-account thresholds miss.

Practical implication: normalize identity and cloud telemetry into one correlation layer before tuning detections.

Threat narrative

Attacker objective: The attacker wants durable access that looks legitimate in logs long enough to collect data, persist, and expand control.

1. Entry occurs when attackers obtain a valid credential artifact such as an OAuth token, session cookie, API key, or service account secret through phishing, infostealers, or reuse.
2. Escalation occurs when the replayed artifact inherits the victim’s authenticated state and lets the attacker move through SaaS, cloud, or mailbox actions without triggering fresh MFA.
3. Impact occurs when the attacker expands access, creates forwarding rules, or extracts data before defenders recognise that the authenticated session was fraudulent.

Breaches seen in the wild

• Dropbox Sign breach — compromised Dropbox Sign service account exposed API keys and OAuth tokens.
• Salesloft OAuth token breach — hackers stole OAuth tokens to access Salesforce data via Salesloft.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Compromised credentials are now a post-authentication detection problem. The traditional IAM assumption is that successful authentication meaningfully proves the actor is the legitimate user. That assumption fails once session cookies, OAuth tokens, and API keys can be replayed without any new login event. The implication is that identity programmes must treat authentication as the beginning of scrutiny, not the end of it.

Session artifacts are now part of the identity perimeter. Password resets do not remove access if refresh tokens, cookies, or service account secrets remain valid. This is the operational reality behind modern credential abuse, and it means lifecycle control has to include revocation of issued artifacts, not only account resets. Practitioners should stop treating credentials as single objects and start treating them as multiple independently governed trust materials.

Static threshold rules are too narrow for credential replay. Attackers deliberately keep failure counts low, reuse valid sessions, or operate through trusted cloud and SaaS paths. A useful named concept here is post-authentication blind spot: the gap where detections only watch for failed logins while the compromise is already underway inside a valid session. Teams that leave this blind spot open will continue to miss the highest-value part of the attack.

Service accounts deserve the same abuse scrutiny as human identities. The article’s examples show that interactive use of non-human identities is a high-fidelity indicator of misuse, especially when service accounts behave like desktop users. That is a governance issue as much as a detection issue, because a non-human identity should have a narrower behavioural envelope than a person. Practitioners need account-class-specific controls, not one IAM control set flattened across all identities.

Rapid containment changes the economics of credential compromise. The longer a fraudulent session remains active, the more likely it is that the attacker will create persistence, modify access, or exfiltrate data before defenders intervene. Internally detected incidents are materially cheaper and shorter because the organisation has enough telemetry to act before the session compounds into a broader breach. The field should treat detection speed as an identity control outcome, not just a SOC metric.

From our research:

• 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
• Lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations, with inadequate monitoring and logging at 37% and over-privileged accounts at 37%.
• That visibility gap is why governance must extend from identity issuance to post-authentication session control, as explored in Ultimate Guide to NHIs , Key Challenges and Risks.

What this signals

Post-authentication blind spot: organisations that still anchor trust on successful login are underestimating how often compromised credentials arrive as already-authenticated sessions. Once token and cookie replay becomes the attack path, the governance question shifts from authentication strength to session invalidation, correlation, and behavioural detection.

The operational signal is clear in NHI and IAM programmes alike. If identity telemetry cannot connect a sign-in to subsequent cloud or SaaS actions, then access reviews and anomaly rules are observing the wrong layer of the problem.

With 1 in 4 organisations already investing in dedicated NHI security capabilities, per The State of Non-Human Identity Security, credential governance is moving from an edge case to a mainstream control domain.

For practitioners

• Revoke sessions before resetting passwords When credential compromise is suspected, terminate active sessions, invalidate tokens, and then rotate passwords or keys. That order matters because the session cookie or refresh token may remain usable even after the password changes.
• Correlate identity and cloud events into one detection layer Join IdP sign-ins, cloud control-plane actions, and SaaS changes on a normalised identity key so a sequence like MFA success, new device fingerprint, and mailbox forwarding rule creation becomes visible as one attack path.
• Flag service account behaviour that looks human Alert on interactive logons, remote interactive logon types, unexpected source hosts, and unusual access bursts for service accounts and workload identities, because those accounts should not behave like end-user desktops.
• Add dark web exposure monitoring to identity response Monitor stealer logs, marketplace postings, and exposed session artifacts so you can trigger validation and forced rotation before compromised credentials are reused against your environment.
• Test detections against low-and-slow abuse patterns Exercise detections for password spraying, AiTM session replay, and token abuse using sequences that avoid per-account thresholds, so you can see whether the controls still surface the attack.

Key takeaways

• Compromised credentials are often valid sessions in disguise, which is why authentication-only monitoring misses the real attack.
• The strongest evidence of abuse is a sequence across identity, cloud, and SaaS logs, not a single failed login event.
• Fast session revocation, not password resets alone, is the control most likely to limit blast radius after credential theft.

Key terms

• Compromised Credential Screening: Compromised credential screening checks new or changed secrets against known breach corpuses before they are accepted. In practice, it prevents users and service owners from choosing passwords that have already been exposed, which lowers account takeover risk and reduces the chance that an identity programme certifies a broken secret.
• Session Artifact: A reusable piece of authentication state such as a cookie, refresh token, or issued bearer token. These artifacts matter because they often outlive the original login event and can continue to grant access after the password has changed or MFA has completed.
• Post-Authentication Blindness: The visibility gap that starts after an identity has authenticated and ends when security teams can reliably see what it did next. In AI agent environments, this gap matters because the most important actions often happen in runtime, across tools, data stores, and sub-agents, not at the login event itself.
• Valid Account Abuse: Valid account abuse occurs when attackers use legitimate credentials or tokens to enter systems and blend in with normal traffic. It is a preferred tactic because it sidesteps many exploit-based controls and inherits existing privilege. In NHI programmes, service accounts and API keys are common abuse paths when scope and rotation are weak.

What's in the full article

Panther's full blog covers the operational detail this post intentionally leaves for the source:

• Concrete log field examples for correlating IdP, SaaS, and cloud control-plane events.
• Detection logic patterns for impossible travel, MFA fatigue, and token replay sequences.
• Step-by-step response sequencing for session revocation, scoping, and coordinated remediation.
• Implementation notes for normalising identities across multiple telemetry sources.

👉 Panther’s full post covers the detection logic, correlation examples, and response sequencing in detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or NHI governance programme, it is worth exploring.