Credential stuffing Credential stuffing does not go after unknown passwords; it tries known ones. With username and password pairs from databases leaked across the internet, the at …

Account Takeover … ly the destination of what came before: phishing, credential stuffing, token theft.

Authentication Bypass An authentication bypass means the attacker reaches a protected part of the system without logging in the ordinary way. They need not know a password. Sometimes a flaw in the logic is enough, or an unprotected endpoint, a predictable token, a misconfigured proxy, or a gap between two steps of the login.

Brute-force attack … P server exposed to the internet with admin/admin credentials and no limit on failed logins. This happens far more often than you would think.

Infostealer … n infostealer has one basic role: to collect your credentials. Saved browser passwords, cookies and session tokens, autofill data, crypto wallet keys — all of i …

IoT Device Compromise IoT device compromise hits cameras, routers, sensors, smart televisions, locks, controllers and all the equipment connected to a network that does not behave like a classic computer. The problem is that these devices are often forgotten the moment they are switched on.

Kerberoasting Kerberoasting is an attack specific to Windows domain networks and Active Directory (AD). User logins are handled by the Kerberos protocol, which issues tickets as proof of identity. In a domain environment there are non-user accounts — service accounts — under which most background tasks and services run, such as databases and business applications. Service accounts are set up so that any user can request a ticket for access to a given service. The catch is that the ticket is encrypted with the service account's password.

Keylogger Keylogger embedded in a trojan collecting banking credentials

Pass-the-Hash … here; protection of the memory the hash lives in (Credential Guard); network segmentation; a move from NTLM to Kerberos. The main recommendation is that privile …

Password spraying Password spraying is brute force turned around. Instead of trying many passwords on one account, the attacker tries common passwords across many accounts. That avoids lockout, because each individual account sees only an attempt or two.

Session Hijacking When you log in, the service opens a session — a state that remembers you are you, together with everything that goes with it, such as your preferences and settings. The main benefit is that you do not have to type a password every few minutes as you move through the features. That session is marked by an identifier, usually held in a browser cookie. Session hijacking is the taking over of a session that is already open. The attacker does not attack the login; they slip into a session that has already passed authentication and carry on operating the service in your name.

Token Theft A token is proof that you have already logged in. When you sign in and confirm your identity with a second factor, the service issues a token, stored in the browser, which vouches that you have already been checked the next time round. The token is sent automatically with every further request, so you do not have to type the password again. Token theft is the taking of that proof. With it in hand, the attacker presents themselves as you — without your password and without the second factor, because both have already been approved.

Backdoor … chine or network, regardless of patching, changed credentials or a reinstalled system.

DNS Poisoning … ut DNS poisoning takes them to a page that steals credentials.

Evil Twin … ects, the attacker can watch the traffic, attempt credential theft, present a fake captive portal, redirect the user, or run an attack as a man in the middle. I …

Malvertising … age for a browser update, a program download or a credential entry. In worse cases a vulnerable browser or extension can be exploited by the content simply load …

Path Traversal … . One configuration file read can reveal database credentials, API keys and internal paths, and from there the attack is no longer reading but a breach of the a …

Phishing … a link, opening an attachment, or entering their credentials somewhere.

Privilege Escalation … running with more rights than they need. Leftover credentials and forgotten administrator accounts are frequent prizes. Each of those mistakes is a shortcut fro …

QR phishing - Quishing … ed document check, but the page asks for business credentials.

SMS phishing - Smishing … rom outside the official store, the attacker gets credentials, payment details or access to the phone.

SSRF … dpoint, the attacker can try to extract temporary credentials and move from one hole in an application to a compromise of the cloud account.

Shared Account Abuse … access belongs behind PAM, session recording and credentials issued for a limited time.

Typosquatting … ng a familiar site but ends up on a fake page for credential theft, malware distribution or advertising. With software packages, a developer installs a package …

Whaling … uments, and the login leads to a page that steals credentials.