Notifications
Clear all
Topic starter
11/07/2026 2:00 pm
TL;DR: Attackers increasingly bypass exploitation by using legitimate authentication workflows, with threat intelligence showing a 500% year-over-year rise in ClickFix-style social engineering and voice impersonation driving password resets and MFA manipulation, according to Enzoic. Password policy compliance does not equal exposure safety; once credentials are known externally, Active Directory becomes an access control problem, not a hygiene problem.
NHIMG editorial — based on content published by Enzoic: The Real Initial Access Vector: Compromised Active Directory Credentials
By the numbers:
- Recent threat intelligence analysis documented a 500% year-over-year increase in ClickFix-style social engineering activity.
Questions worth separating out
Q: What breaks when Active Directory password policy is treated as the main security control?
A: Password policy can prove a secret meets internal rules, but it cannot prove the secret was never exposed elsewhere.
Q: Why do compromised domain credentials increase lateral movement risk in hybrid environments?
A: A single exposed Active Directory credential can unlock more than one system because many enterprises synchronise identity across VPN, SaaS, and privileged platforms.
Q: How do security teams know if credential exposure screening is working?
A: Look for fewer successful logins from credentials already found in breach datasets, faster blocking of exposed passwords, and lower rates of reset-driven re-entry by the same accounts.
Practitioner guidance
- Add exposure checks before authentication succeeds Screen domain credentials against breach and infostealer intelligence before allowing successful logon, and block or step up authentication when exposure is confirmed.
- Treat password reset workflows as security decisions Require stronger identity verification, managerial or risk-based review, and exposure screening before any reset or MFA change is completed in Active Directory.
- Measure exposed credentials inside the directory Track how many active domain credentials appear in external compromise datasets, then report that number alongside password compliance and MFA coverage metrics.
What's in the full article
Enzoic's full article covers the operational detail this post intentionally leaves for the source:
- Specific examples of ClickFix-style social engineering and why those lures bypass technical exploit detection.
- A deeper breakdown of how help desk impersonation leads to password resets and MFA manipulation in practice.
- The credential exposure screening approach used to evaluate whether a password is already present in breach datasets.
- The AD-focused risk framing that connects authentication abuse to hybrid environment access paths.
👉 Read Enzoic's analysis of compromised Active Directory credentials and initial access →
Compromised Active Directory credentials: is authentication your weakest link?
Explore further
11/07/2026 2:10 pm
Authentication exposure, not password weakness, is the modern control failure. This article shows that a credential can satisfy internal policy and still be dangerous if it exists in external breach data or infostealer logs. That means the programme assumption that policy compliance equals safety no longer holds. Practitioners should treat exposure history as part of identity risk, not as an adjacent intelligence feed.
A few things that frame the scale:
- 23.7% of organisations share secrets through insecure methods such as email or messaging applications, according to The 2024 Non-Human Identity Security Report.
- Only 19.6% of security professionals express strong confidence in their organisation's ability to securely manage non-human workload identities.
A question worth separating out:
Q: Who is accountable when a reset or MFA change is abused in Active Directory?
A: Accountability sits with both identity governance and the support process owner, because password resets and MFA changes are access decisions, not clerical tasks. The organisation needs clear approval logic, assurance checks, and escalation thresholds so that identity recovery cannot be turned into a social-engineering pivot.
👉 Read our full editorial: Compromised Active Directory credentials are now the real initial access vector
