Credential Compromise

Credential compromise is the most common initial access vector in cloud breaches, enabling attackers to impersonate legitimate users.

Common causes

• Phishing: Users tricked into revealing credentials.
• Credential stuffing: Reused passwords from other breaches.
• Secrets in code: API keys committed to repositories.
• Malware: Keyloggers and info-stealers.
• Insider threat: Malicious or negligent employees.

Indicators of compromise

• Logins from unusual locations or IP addresses.
• API calls at unusual times or volumes.
• Access to resources outside normal patterns.
• Multiple failed authentication attempts.
• New access keys or service accounts created.

Immediate response

1. Disable or rotate compromised credentials.
2. Revoke active sessions for affected accounts.
3. Review audit logs for unauthorized activity.
4. Check for persistence mechanisms (new users, keys, roles).
5. Assess scope of data access or exfiltration.

Prevention measures

• Enforce MFA on all accounts, especially privileged.
• Use short-lived credentials and automatic rotation.
• Implement secrets management solutions.
• Monitor for leaked credentials in public repositories.
• Deploy phishing-resistant authentication (FIDO2).