Credential theft: are your access controls keeping up?

TL;DR: Cybercriminals are increasingly using stolen usernames, passwords, tokens and session cookies to log in through legitimate channels, which makes breach activity harder to detect and turns one compromised account into a path to sensitive systems, lateral movement and data access, according to ThreatLocker. The core problem is not just stolen secrets, but the trust assumptions built into remote access and session handling.

Editorial analysis by NHI Mgmt Group, based on content published by ThreatLocker: “Cybercriminals are increasing credential theft attacks”.

By the numbers:

• 22% of the breaches assessed in Verizon’s 2025 DBIR used compromised credentials as the initial access vector.
• ThreatLocker says stolen credentials are involved in roughly 60% of financial cyberattacks.
• The article says an illicit database contained over 149 million usernames and passwords.

Key questions

Q: What breaks when stolen credentials are replayed as valid logins?

A: What breaks is the assumption that successful authentication equals legitimate use.

Q: Why do stolen credentials create such high risk in cloud identity attacks against SaaS and IdPs?

A: Stolen credentials are dangerous because they often unlock trusted identity paths rather than just a single app.

Q: How can security teams detect credential theft attacks?

A: Security teams detect credential theft attacks by watching for stolen secrets being used from new devices, locations or applications.

Practitioner guidance

• Restrict login to approved devices and locations Require SaaS, cloud and remote-access logins to originate from approved endpoints, networks or brokered access paths so stolen credentials are not usable everywhere.
• Invalidate live sessions after suspected compromise Terminate active cookies, tokens and authenticated sessions when credential theft is suspected so an attacker cannot keep using an already-issued trust state.
• Reduce the scope of each account Enforce least privilege and remove unnecessary local admin rights so a compromised identity cannot reach more systems than it truly needs.

Bottom line: Credential theft now works because attackers can use legitimate authentication paths, not because they need to break encryption or exploit code.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →