Who’s Logging In? [OMITB]

The episode opens with a stark shift in threat data: Sophos’ 2026 Active Adversary Report, SpyCloud’s identity exposure findings, and Red Canary’s detection study all show identity‑related incidents now dominate, accounting for more than half of confirmed attacks. With 414 billion compromised credentials floating in underground caches, threat actors are abandoning traditional malware exploits in favor of direct credential abuse. This trend matters because identity compromise grants attackers immediate, unrestricted access to cloud services, privileged accounts, and sensitive data, reshaping the cyber‑risk landscape for enterprises worldwide.

Hosts dive into the mechanics behind the surge. Info‑stealers harvest an average of 87 credentials per infected device, while token‑theft techniques let adversaries reuse session cookies and API keys even after multi‑factor authentication (MFA) is enabled. Their data shows 99% of organizations faced account‑takeover attempts, with 67% succeeding and 59% of those accounts protected by MFA—highlighting sophisticated phishing kits like Tycoon, sold for $120 on Telegram, that bypass MFA through man‑in‑the‑middle attacks. The discussion underscores that MFA alone no longer guarantees security; attackers now exploit credential‑phishing, token replay, and social engineering to impersonate legitimate users.

To counter this identity‑first threat model, experts recommend a zero‑trust architecture combined with strict least‑privilege controls and conditional access policies. Micro‑segmentation, continuous monitoring of privileged account sprawl, and hardware security keys—still 99.9% effective against account takeover—form a layered defense. By treating identity as the new perimeter and enforcing granular access rules, organizations can detect anomalous logins, limit lateral movement, and ultimately reduce the attack surface that credential theft seeks to exploit.