Identity Attacks

Expanded Definition

Identity attacks are browser-mediated attempts to capture or abuse identity artifacts such as passwords, session cookies, refresh tokens, SSO assertions, and device-bound authentication state. The term is broader than classic credential theft because it includes post-login compromise, where an attacker does not need to know the password if they can reuse a valid session or extract a token from browser storage. In practice, identity attacks often combine phishing, malicious browser extensions, consent abuse, clipboard interception, or same-device malware that targets the browser’s trusted position in the authentication flow.

For security teams, the key distinction is that the browser is not just a user interface, it is a security boundary holding live access material. That is why identity attacks sit at the intersection of IAM, endpoint hardening, and user session governance. MITRE ATT&CK Enterprise Matrix is useful for mapping the surrounding tactics, while browser-specific identity abuse is increasingly discussed in relation to NHI and agentic workflows where tokens can outlive the user interaction that created them.

The most common misapplication is treating identity attacks as simple phishing, which occurs when teams ignore session replay, token theft, and local browser storage exposure.

Examples and Use Cases

Implementing defences against identity attacks rigorously often introduces friction in browser UX and session handling, requiring organisations to weigh tighter control of identity artifacts against user convenience and operational continuity.

• A user enters credentials into a spoofed login page, and the attacker reuses the harvested SSO session to access email and SaaS apps without triggering password change controls.
• A malicious browser extension reads tokens from browser storage or injects scripts that exfiltrate session cookies before the user notices any suspicious behaviour.
• A helpdesk compromise or consent phishing event grants an attacker access to an application session, allowing them to pivot into cloud tools with the victim’s identity.
• An endpoint infection captures browser-based authentication artefacts and lets the attacker resume a valid session after MFA has already been completed.
• Security teams use advisories such as CISA cyber threat advisories to track browser exploitation patterns that commonly support identity abuse chains.

Why It Matters for Security Teams

Identity attacks matter because they collapse the assumption that authentication ends when a password or MFA prompt succeeds. Once a browser session is hijacked, attackers can operate as the legitimate user, often bypassing controls that only inspect login events. That makes this term especially important for IAM, SOC, and endpoint teams that need to coordinate on session lifetime, token protection, conditional access, and browser hardening.

The security impact is especially severe in SaaS-heavy environments, where browser sessions often carry access to email, source code, finance systems, and admin consoles. NIST SP 800-53 Rev 5 Security and Privacy Controls is relevant here because session management, access enforcement, and authentication safeguards all depend on disciplined control implementation. Where agentic AI or NHI systems use browser-adjacent identities or delegated tokens, the same attack pattern can expose non-human access paths as well as human ones. For emerging AI-driven intrusions, the Anthropic — first AI-orchestrated cyber espionage campaign report illustrates how attackers increasingly automate reconnaissance and abuse workflows that can support identity compromise. Organisations typically encounter the business impact only after an account is used to send fraud, exfiltrate data, or alter settings, at which point identity attacks become operationally unavoidable to investigate.

Related resources from NHI Mgmt Group

• Identity Blast Radius
• Why are identity-based attacks growing faster than traditional network attacks?
• Why are identity-driven attacks harder to detect than malware-based attacks?
• Why are valid credentials so dangerous in identity attacks?