Credential abuse is hiding in plain sight across account takeover

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Abnormal AI's blog post: Account takeover campaigns are becoming quieter and harder to spot because malicious sign-ins blend into normal activity until correlated across accounts, infrastructure, and time.

Why it matters: IAM and detection teams need to move beyond single-login alerts and treat correlation as the control that exposes coordinated abuse across human and non-human access paths.

Context

Account takeover is not failing because attackers are noisier, but because the underlying detection model still assumes suspicious activity will stand out in a single sign-in or a short time window. The article argues that credential abuse is now being executed in ways that look ordinary at the point of inspection.

In identity programmes, that means the control problem has shifted from identifying one bad login to recognising a campaign that reuses infrastructure, timing, and access paths across multiple accounts. The relevant question is no longer whether a login looks plausible in isolation, but whether the pattern is plausible across the full identity estate.

Key questions

Q: What breaks when account takeover signals are evaluated in isolation?

A: When security teams evaluate each login, mailbox rule, or token capture on its own, modern account takeover often looks routine. Attackers rely on low-signal actions that blend into normal activity. Effective defence depends on correlating identity, endpoint, and time-based behaviour so weak indicators combine into a recognisable campaign and can be contained before persistence is established.

Q: Why do reused VPN and proxy patterns matter in account takeover investigations?

A: Reused VPN and proxy patterns matter because they reveal infrastructure shared across multiple identities, not just a single unusual session. When the same egress points appear across users or time periods, the behaviour is much more consistent with coordinated abuse than with a random login anomaly.

Q: How should teams use IdP risk scores in suspected account takeover cases?

A: Use them as one input, not the deciding factor. A sign-in marked safe can still be malicious when other evidence shows MFA bypass, unusual browser traits, or infrastructure reuse. The right practice is to corroborate vendor telemetry with independent identity signals before closing the case.

Q: What is the difference between an unusual login and a coordinated takeover campaign?

A: An unusual login is a single suspicious event that may be explainable on its own. A coordinated takeover campaign shows repeated relationships across identities, IPs, timing, and session characteristics, which means the attacker is operationalising access rather than stumbling into it once.

Technical breakdown

Why isolated sign-ins miss account takeover campaigns

Modern account takeover often relies on legitimate-looking access events that are individually low confidence. Attackers use stolen credentials, forged tokens, VPNs, proxies, and normal working-hour timing to keep each login within expected bounds. A single event can pass risk checks even when the surrounding campaign is malicious. The real signal appears only when identity telemetry is stitched across accounts, IP blocks, devices, and time windows. That is why correlation, not raw alert volume, becomes the deciding factor in exposure. Practical implication: build detection logic that groups low-signal events into campaigns rather than scoring each login in isolation.

Practical implication: correlate identity events across accounts, infrastructure, and time before deciding whether a sign-in is benign.

How proxy and VPN reuse changes the detection problem

Proxy and VPN infrastructure are not suspicious by themselves, but repeated reuse across multiple accounts is a strong campaign indicator. Attackers hide behind shared egress points to make origin look routine and to defeat rules that rely on one account, one IP, one decision. When the same infrastructure appears across separate users or discrete time windows, the pattern becomes the threat. This is a telemetry problem as much as a fraud problem: defenders need reusable infrastructure detection, not only anomalous login scoring. Practical implication: treat repeated IP blocks and shared proxy infrastructure as campaign evidence, not just noisy sign-in metadata.

Practical implication: flag repeated IP and VPN infrastructure across users as campaign evidence, not just sign-in noise.

Why vendor-safe sign-ins can still hide compromise

The article’s Microsoft example shows a broader governance failure: an identity provider can label a sign-in safe while an attacker has already bypassed MFA. That does not mean the provider is wrong, but it does mean vendor telemetry is not sufficient as a standalone trust decision. Account takeover detection has to reconcile multiple evidence sources, including message anomalies, browser traits, geolocation, and reuse patterns that sit outside a single platform’s risk score. Practical implication: do not let one vendor signal overrule cross-domain identity evidence when building ATO response logic.

Practical implication: combine IdP risk scores with independent identity telemetry before closing or suppressing an account takeover case.

Threat narrative

Attacker objective: The attacker wants to turn apparently routine logins into durable, campaign-level account compromise that survives standard detection and response.

1. Entry begins with phishing or credential theft that gives the attacker valid sign-in material, including forged tokens or stolen credentials.
2. Escalation occurs through proxy or VPN reuse, low-and-slow timing, and repeated access across multiple accounts to keep each event below standard thresholds.
3. Impact emerges only after correlation reveals a coordinated campaign that can lead to broader account compromise and lateral movement across tenants.

Breaches seen in the wild

• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.
• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Credential abuse is now a campaign problem, not a single-event problem. The article shows that attackers are winning by making each login look ordinary enough to avoid immediate attention. That shifts the governance burden from per-event screening to cross-event interpretation, where correlation across users, infrastructure, and time becomes the control boundary. Practitioners should treat isolated sign-in review as incomplete evidence.

Identity risk scores cannot be the final authority on account trust. The Microsoft example is the key signal here: a sign-in can be marked safe while the attacker has already bypassed MFA and established access. That means platform-native risk telemetry is necessary but not sufficient for identity governance. The implication is clear: programmes need independent corroboration before they suppress, close, or downgrade suspected takeover activity.

Correlation is the new detection primitive for account takeover. Reusing IP blocks across accounts and windows is not just a technical artefact, it is a named operational clue that the same adversary is moving through the estate. This is where behavioural AI and identity analytics matter, but only if they are used to connect weak signals into a coherent attacker timeline. The practitioner takeaway is to operationalise campaign correlation, not just anomaly scoring.

Cross-account infrastructure reuse creates identity blast radius. Once shared VPN or proxy infrastructure appears across multiple users, the compromise stops being a single-user problem and becomes a programme-level exposure. That makes access containment, case prioritisation, and investigation sequencing more important than chasing every low-fidelity alert. Security teams should assume that repeated infrastructure tells you more than repeated logins do.

Low-and-slow credential abuse exposes the limits of static thresholds. The quietest campaigns are often the hardest to govern because they exploit the gap between what looks unusual and what looks actionable. That gap is where account takeover now lives. Practitioners need controls that reason over timing, infrastructure, and identity relationship patterns rather than relying on one-off anomalies.

What this signals

Identity teams should stop treating login anomalies as self-contained incidents. The behaviour described here is only visible when events are stitched together across users and time, which makes correlation a governance capability rather than a nice-to-have detection feature.

Campaign-aware ATO detection changes the unit of analysis. The meaningful control boundary is no longer the individual account, but the shared infrastructure and behavioural pattern that links multiple accounts into one attack chain.

For practitioners

• Build cross-account correlation rules Group sign-ins by shared IP blocks, proxy infrastructure, browser traits, and session timing so that one-off events are evaluated as campaign evidence instead of isolated noise.
• Review vendor risk scores against independent telemetry Treat IdP trust labels as one input, then validate them against message anomalies, geolocation drift, and infrastructure reuse before suppressing a suspected takeover case.
• Prioritise reused infrastructure for triage Escalate cases where the same VPN or proxy egress appears across multiple users or time windows, because that pattern is stronger than a single unusual login.
• Reduce alerting on single low-signal logins Tune detections to suppress isolated benign-looking sign-ins unless they connect to a broader pattern, so analysts spend time on attacker campaigns rather than login churn.

Key takeaways

• Credential abuse is increasingly quiet, which means single sign-in alerts are a weak basis for deciding whether access is legitimate.
• The important evidence is often spread across accounts, IPs, and timeframes, not concentrated in one obvious compromise event.
• Defenders need correlation-driven detection and independent identity validation to keep account takeover from blending into normal activity.

Key terms

• Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
• Campaign Correlation: The process of linking multiple malicious messages or events to the same attack pattern. It helps teams see a phishing campaign rather than isolated emails, which improves containment, reduces repeated manual effort, and speeds organisation-wide remediation.
• Proxy Infrastructure Reuse: Proxy infrastructure reuse occurs when attackers repeatedly route activity through the same VPNs, proxies, or IP blocks across multiple accounts. This pattern is valuable to defenders because it can expose a wider campaign even when each individual session appears plausible.
• Risk Telemetry: Risk telemetry is the set of signals an identity platform emits to indicate whether a sign-in or session may be suspicious. It helps guide triage, but it is not a complete trust decision on its own, especially when attackers are using tactics that stay below single-event thresholds.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.