Topic starter
24/10/2026 8:49 pm
TL;DR: Credential theft campaigns keep working when stolen passwords and session tokens are still accepted as legitimate access, according to Todyl. Cloud platforms then concentrate sensitive data behind reusable identity artefacts, so one compromised login can widen exposure fast.
Editorial analysis by NHI Mgmt Group, based on content published by Todyl: “How Credential Theft Attacks Are Costing MSP Clients Millions”.
Key questions
Q: Why do stolen session tokens create so much more risk than ordinary file theft?
A: Stolen session tokens are risky because they can bypass password checks and act like already authenticated access.
Q: What should MSPs prioritise first after discovering credential theft exposure?
A: Prioritise containment of active sessions, enforcement of MFA everywhere and review of the cloud repositories that hold the most sensitive client data.
Q: What breaks when stolen credentials are enough to access cloud platforms?
A: The control that breaks is the assumption that successful authentication equals legitimate access.
Practitioner guidance
- Enforce MFA across every cloud access path Remove exceptions for legacy apps, shared collaboration tools and administrative portals so a stolen password cannot become a valid session.
- Shorten the useful life of stolen sessions Revoke sessions on suspicious device events, require reauthentication after risk spikes and treat token theft as a containment trigger.
- Inventory where the most sensitive data lives Identify cloud platforms holding customer records, strategy documents, legal files and engineering assets, then apply stricter access scoping to those repositories.
Bottom line: Credential theft campaigns succeed when stolen passwords and session tokens are still accepted as legitimate access.
Glossary terms: Credential Theft, Session Token Exposure, Blast Radius, Credential Reuse
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
25/10/2026 11:11 am
Identity review is failing because the attacker is reviewing the session, not the organisation. Credential theft attacks collapse the assumption that access review can happen after the fact. When malware captures a live session token, the attacker can operate inside an already-trusted context before any periodic review catches up. The practitioner conclusion is blunt: governance that only checks who was granted access is missing how that access is actually reused.
A question worth separating out:
Q: How do cloud collaboration tools change the impact of identity compromise?
A: They concentrate sensitive files, business plans and customer data behind easy-to-use access paths, so one compromised account can expose far more than a single device or mailbox. That makes blast radius and access scoping the central design variables, not just account hygiene.
👉 Read our full editorial: Credential theft is exposing cloud data despite basic access controls
This post was modified 6 days ago by NHI Mgmt Group