Security teams train for intrusion detection. They build defenses around the assumption that attackers will force their way in. Those attack vectors still exist. But they are no longer where the most damaging breaches begin.
The Verizon 2024 Data Breach Investigations Report found that stolen credentials were involved in over 40% of breaches analyzed. These are not sophisticated zero-day exploits. They are login events using real usernames and real passwords.
Step One: Enter Through the Front Door
Attackers acquire credentials through phishing campaigns, dark web marketplaces, info-stealer malware, and social engineering. With valid credentials, the attacker authenticates normally. If the attacker has stolen a session token or cookie rather than a password, MFA is bypassed entirely because the session is already authenticated.
The Snowflake breach of 2024 illustrated this pattern. Attackers used credentials stolen by malware as far back as 2020 to access cloud environments at over 160 organizations. According to Mandiant's investigation, over 500 million records were exposed before the campaign was identified.
Step Two: Blend Into Normal Operations
Once inside, attackers observe. They navigate applications the way a normal user would. They access systems during business hours. They avoid bulk data downloads or sudden privilege escalations that might trigger alerts.
Step Three: Execute High-Value Actions
When the time is right, attackers act: initiating wire transfers, modifying account settings, escalating privileges, exfiltrating data. These actions occur within valid sessions using valid tokens. From the system's perspective, they are indistinguishable from normal operations.
The Arup deepfake incident of January 2024 demonstrated an extreme version. AI-generated video of a CFO and colleagues on a live video call convinced a finance worker to transfer $25.6 million across 15 wire transfers. The employee believed they were interacting with real colleagues. The behavioral signature was the only thing that would have been different. This incident was confirmed by CNN, Fortune, and Hong Kong Police.
Why Detection Fails
Traditional detection systems look for known patterns: malware signatures, anomalous IP addresses, impossible travel events. Session-level impersonation avoids all of these triggers. The credentials are valid. The location may be plausible. The actions happen within expected parameters.
Detecting this class of attack requires monitoring behavior inside the session continuously. Not at login. Not after an alert. Every second.
Sources: Verizon, 2024 Data Breach Investigations Report (verizon.com/dbir). Mandiant, Snowflake breach investigation (cloud.google.com/blog/topics/threat-intelligence). CNN and Fortune, Arup deepfake reporting, January 2024.