Credential abuse is driving this week’s breach pattern

At a glance

What this is: This weekly intelligence report says the dominant breach pattern for 17 to 23 August 2026 was credential abuse, with valid access driving most of the week’s major incidents.

Why it matters: IAM, NHI, PAM, and detection teams should treat credential abuse as an attack path that bypasses perimeter thinking and turns authentication outcomes into a control signal, not a trust signal.

Context

Credential abuse is the use of stolen, sprayed, or socially engineered login material to enter an environment through an authorised path. In this report, FireCompass frames that pattern as the defining feature of the week, because attackers used valid access more often than malware to reach systems and data.

For identity programmes, the important point is not just that credentials were compromised. It is that access points, second factors, and remote entry paths became the primary attack surface, which shifts the control question from whether users can authenticate to whether that authentication should still be trusted after the fact.

The report’s incidents span public-sector, university, and enterprise environments, which makes the pattern broader than any single vertical. The common failure mode is not a missing alert alone, but the assumption that successful sign-in is sufficient evidence of legitimacy.

Key questions

Q: What breaks when password spraying and MFA fatigue are your main attack path?

A: Authentication stops being a trust boundary when attackers can cycle through common passwords and wear users down with repeated prompts. The failure is not just account takeover, but the assumption that sign-in success means the actor is legitimate. Teams need controls that resist both low-volume guessing and human fatigue.

Q: Why do valid accounts make breach detection harder for IAM teams?

A: Valid accounts bypass many of the signals that traditional security controls expect, because the login itself is authorised. The risk rises when attackers use stolen credentials, service accounts, or tokens to authenticate normally and then act inside trusted systems. IAM teams must therefore watch for misuse after login, not just failed authentication.

Q: What signs show that credential abuse is already active in a tenant?

A: Look for repeated failed logins across many users, bursts of MFA prompts, unusual geo or ASN patterns, and sudden data reads or exports from accounts that normally do not move large volumes. Those signals often appear before overt compromise becomes visible, especially in cloud and SaaS environments.

Q: What should organisations do when a compromised account is confirmed in an email fraud incident?

A: Once a compromised account is confirmed, teams should move fast to cut off the attacker’s ability to act from a trusted mailbox. Typical actions include forcing a password reset, suspending the account, revoking the active session, and applying risk-based authentication. The priority is to stop reconnaissance and prevent fraudulent messages from reaching internal or external recipients.

Technical breakdown

Why valid accounts remain the most reliable entry path

Valid accounts work because many defensive controls still assume that authentication success is evidence of legitimate intent. MITRE ATT&CK calls this T1078, Valid Accounts, and it covers abuse of existing identities rather than technical exploitation. Once attackers hold a genuine credential, they can blend into normal access patterns, especially when the account already has routine access to the target system. That makes the initial compromise less visible than malware-based intrusion and often more durable because it uses sanctioned paths. The technical problem is not just possession of the credential, but the fact that the environment continues to treat that credential as normal after compromise.

Practical implication: Track high-risk logins as potential compromise events, not routine authentication successes.

How password spraying and MFA fatigue defeat weak access design

Password spraying uses a small set of common passwords across many accounts to avoid lockout thresholds, while MFA fatigue relies on repeated prompts until the user approves one. Together they attack the authentication workflow, not the network perimeter. The report’s Azure tenant story and TCS disclosure show why push-based MFA can still fail when human response becomes the weak link. These techniques do not require a vulnerability in Azure itself; they exploit predictable behaviour and permissive remote access design. From an identity perspective, the issue is that second-factor prompts can become a nuisance channel rather than a trust control.

Practical implication: Move privileged and remote access away from push approval and toward phishing-resistant authentication.

Why purchased footholds turn access brokers into a supply chain

The Medusa advisory in the report shows how access brokers buy and sell initial entry through stolen credentials and exposed services. That changes ransomware from a one-off intrusion into a market with repeatable supply. A purchased foothold matters because it often arrives with a legitimate session, a working VPN path, or access to a cloud tenant that appears authorized at first glance. The attacker then uses that access to move toward encryption, exfiltration, or both. This is why valid access is such an effective precursor to impact: it shortens the path from entry to action and reduces the number of controls that must be bypassed after the initial login.

Practical implication: Assume any externally exposed credential path can be monetised before defenders notice the compromise.

Threat narrative

Attacker objective: The attacker wants durable, low-noise access that can be converted into data theft, operational disruption, or ransomware leverage without relying on malware first.

1. Entry begins with sprayed, phished, or purchased credentials that open a legitimate authentication path instead of a malicious exploit.
2. Escalation follows when repeated MFA prompts, weak remote access design, or reused credentials let the actor keep access long enough to reach sensitive systems.
3. Impact arrives as data extraction, tenant compromise, ransomware enablement, or large-scale account abuse that looks like normal authorised activity at first.

Breaches seen in the wild

• CircleCI breach 2023: Malware stole a CircleCI engineer's SSO session; attackers exfiltrated customers' CI/CD secrets and keys, forcing a platform-wide rotation.
• New York Times GitHub breach 2024: An exposed GitHub token gave an attacker The New York Times' repositories; the 270GB leak held 4,875 unique secrets.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Credential abuse is now the control plane, not a side channel: This report shows that modern breach activity often begins where identity systems say access is normal. That makes authentication outcomes a security signal that must be continuously reinterpreted, not a one-time gate. The implication is that programmes built around perimeter trust are already late by the time the account is accepted.

Push MFA fatigue is a governance failure, not just a user problem: Repeated approval prompts shift the burden of security onto the person being attacked, which is why this technique keeps working at scale. The more a control depends on user patience, the more it behaves like a nuisance channel rather than a trust mechanism. Practitioners should treat fatigue-resistant authentication as an access governance issue, not a helpdesk issue.

Access brokers prove that initial access is an economy: Medusa’s model shows that stolen credentials and exposed services can be purchased, reused, and resold like infrastructure. That means defenders are not only fighting intrusions, they are fighting a market that prices weak identity controls. The implication is that external attack surface, authentication design, and tenant hardening need to be measured as one control surface.

Valid accounts collapse the old malware-first breach model: This week’s cases show that compromise often arrives through approved paths, which is why detection based only on malicious code misses the dominant threat pattern. In identity terms, the account, the second factor, and the remote access route all need to be treated as attack vectors. Practitioners should reframe breach prevention around access provenance, not just payload inspection.

Identity blast radius is now the decisive containment concept: When a credential or session is abused, the real question is how far that access can move before it is constrained. This week’s incidents show that even limited initial access can turn into broad extraction when privilege, remote paths, and detection latency align. The practitioner takeaway is to measure how much damage one valid login can do before it is contained.

What this signals

Credential abuse is the primary breach pattern to plan for: Security programmes should stop treating successful authentication as a stable indicator of trust. When sprayed passwords, fatigue attacks, and purchased footholds all work against the same environment, the relevant control question becomes how much damage a valid account can do before containment.

Identity blast radius now matters more than perimeter strength: The practical test is whether a compromised credential can reach administration, backup, and data-export paths from the same session. If it can, the programme still assumes too much trust after authentication and too little risk after access is granted.

For practitioners

• Audit externally reachable access paths Inventory every internet-facing login, partner portal, API auth path, and vendor remote access route, then test them from the attacker’s side to see which ones accept valid accounts too easily.
• Replace push MFA for privileged access Move admin and high-risk remote access to phishing-resistant methods such as FIDO2 or number matching, and remove approval-based MFA from accounts that gate sensitive systems.
• Simulate password spraying against your tenant Run external spray simulations at attacker cadence and measure whether lockout, alerting, and conditional access controls actually interrupt the attempt before account takeover.
• Monitor bulk export and read volume per account Alert on abnormal extraction patterns from taxpayer, student, employee, and admin accounts because valid access often looks benign until the data volume changes.
• Segment remote access from management and backup planes Ensure a compromised VPN, vendor account, or cloud session cannot reach backup systems, tenant administration, or other high-value control planes without an additional trust check.

Key takeaways

• Valid credentials now function as a common breach entry point, which means authentication outcomes must be treated as provisional rather than trusted.
• This week’s incidents show that the scale of exposure comes from access reuse and weak second-factor design, not only from malware or vulnerability exploitation.
• Reducing the damage requires tighter access provenance, stronger phishing-resistant MFA, and narrower paths from a login to high-value systems.

Key terms

• Valid accounts: Legitimate credentials, tokens, or identities that an attacker uses to authenticate normally. The danger is not the login method itself, but that trusted access can be abused without triggering many traditional malware or perimeter alerts.
• Password Spraying: A guessing technique that uses a small set of common passwords against many accounts to avoid lockouts and detection. It is effective when organisations do not reject common passwords, do not monitor patterns across identities, or allow too much standing access.
• MFA Fatigue: MFA fatigue is the behavioural pressure created when repeated login prompts make a person more likely to approve access without checking carefully. It is a control failure in the authentication experience, and it becomes dangerous when the approved session carries broad privilege or long-lived access.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.