Identity Thieves Evolving Tactics Beyond Stolen Passwords
Cybercriminals are increasingly using methods like session hijacking and SIM swaps to access accounts without needing direct password theft.
Online criminals are employing a range of sophisticated techniques to gain unauthorized access to accounts, moving beyond traditional password theft. These methods include hijacking active login sessions, exploiting multi-factor authentication (MFA) prompts, and using malware to extract sensitive information.
Stolen Login Sessions
One prevalent threat involves the theft of digital tokens or cookies associated with active login sessions. When a user logs into a website or service, a session is created that verifies their identity. Attackers can steal these session credentials, allowing them to access an account without needing the password or going through additional verification steps. To mitigate this, users are advised to regularly review connected devices and active sessions for their accounts, revoking access for any unrecognized entries.
SIM Swaps and Phone Account Fraud
Another common tactic is the SIM swap scam. In this scenario, criminals deceive mobile carriers into transferring a victim's phone number to a SIM card they control. This allows them to intercept calls and text messages, including crucial account verification codes. A sudden loss of cellular service can be an indicator of such fraud, along with unexpected carrier notifications. Protective measures include asking mobile carriers for account security PINs and transfer locks.
MFA Fatigue and Fake Approvals
While multi-factor authentication (MFA) adds a layer of security, attackers can exploit it through methods like "MFA fatigue" or "push bombing." This involves bombarding users with authentication requests, hoping they will eventually approve one out of annoyance. Criminals may also impersonate support staff to trick individuals into revealing one-time security codes. Users are urged to never approve login requests they didn't initiate and to report any suspicious activity.
Malware and Risky Browser Extensions
Malicious software, particularly "infostealers," can be distributed through fake software updates, pirated applications, or compromised browser extensions. These programs are designed to steal stored passwords, session cookies, and payment information from a user's device. Maintaining updated operating systems, browsers, and security software, alongside cautious downloading habits, is crucial for defense.
Malicious Apps and OAuth Consent Phishing
Criminals are also using "OAuth consent phishing" to trick users into granting malicious applications access to their accounts. These apps may present legitimate-looking permission screens, requesting access to sensitive data like emails or cloud files. Even if a password is later changed, the granted permissions can allow continued access unless explicitly revoked. Regularly reviewing and removing unnecessary third-party app permissions is essential.
Passkeys and Evolving Security
Passkeys offer a more secure alternative to passwords by using cryptographic credentials tied to a specific device or service, making them resistant to traditional phishing. However, they do not eliminate all risks, as existing authenticated sessions or compromised devices can still be exploited. Experts recommend using passkeys where available and maintaining strong device security and recovery information.
Recovering from Account Takeover
In the event of a suspected account takeover, immediate action is critical, particularly with primary email accounts. This includes changing passwords, revoking suspicious sessions, checking recovery information, and reviewing connected applications. For financial accounts, monitoring transactions and contacting financial institutions about any suspicious activity is vital. The Federal Trade Commission's IdentityTheft.gov provides resources for victims of identity theft.
Regularly reviewing security settings, active sessions, and app permissions for critical accounts can significantly enhance personal cybersecurity and prevent unauthorized access.