Why Attackers Log In Rather Than Break In

Picture how work happened in 2005. Documents sat on a server in the building. Mail arrived on a machine in a cupboard down the corridor. To reach any of it you had to be physically inside, or dial in through a connection the organisation controlled.

Security followed the shape of that world. Build a strong boundary, treat inside as trusted, and control the gate.

Now picture your own working week. Files in cloud storage, mail from a phone on a train, chat on a personal laptop, a dozen services from as many vendors, several of which the IT team may not know about. There is no gate, because there is no wall for a gate to sit in.

What remains is the login. Every one of those services asks the same question: are you who you claim to be? Answer correctly and everything opens.

Where credentials come from

Attackers obtain working credentials through four main routes, and none of them require technical brilliance.

Reuse from an unrelated breach. A hobby forum you registered with in 2013 is compromised and the password appears in a public collection. If that password, or a small variation of it, protects your work account, an attacker who has never targeted your company now has access. Automated tools test billions of these combinations continuously.

Real time phishing. A convincing fake login page captures what you type. The next lesson covers why this defeats most multi factor authentication.

Malware on a device. Software that records keystrokes or steals stored session data. Frequently arrives through a downloaded application rather than a dramatic exploit.

Purchase. Credentials are traded as a commodity. Someone else does the stealing and sells access, which means the person using your password may have no idea who you are.

Why a legitimate login is so hard to catch

Here is the property that makes this the dominant technique.

When an attacker exploits a software flaw, something abnormal happens. Software behaves in ways it was not designed to. That abnormality is detectable, and much of the security industry exists to detect it.

When an attacker signs in with valid credentials, nothing abnormal happens at all. The system performs precisely the operation it was built to perform. There is no exploit to detect, no malicious file, no unusual instruction. There is a successful authentication, which is the single most common event in any system.

Detection therefore has to fall back on weaker signals: is this location plausible, is this hour normal, is this device familiar, is the pattern of activity consistent with the person. All useful, all noisy, and all defeated by an attacker who logs in during working hours from a nearby location.

A stolen credential does not look like an attack. It looks like an employee.

Why email is the account that matters most

If you protect one account properly, protect the email account, and the reason is mechanical rather than a matter of sensitivity.

Consider what happens when you forget a password on any other service. You click "forgot password", and a reset link arrives in your email. Whoever controls the mailbox controls that reset. Repeat across every service you use.

Your email account is therefore not one account among many. It is the master key to almost all of them, and an attacker who holds it can systematically take everything else without ever needing to steal another password.

This has a practical consequence for the order in which you do things. Securing your banking and leaving your email weak is like fitting an expensive lock to a door while leaving the key under the mat.

Understanding the attacker's sequence explains why several of the recommendations in this course exist, and why speed matters so much in Module 6.

Establish persistence. Before doing anything visible, the attacker ensures they can return. They add a recovery email address, register an additional authentication device, or create an application specific password. The purpose is that changing your password later will not remove them, which is why the incident response steps in Module 6 include revoking sessions and auditing recovery settings rather than only resetting the password.

Set up quiet collection. A mail forwarding rule sends copies of incoming messages elsewhere. Frequently paired with a filter that moves anything matching "invoice", "payment" or "security alert" straight to an archive folder, so you never see the warnings the provider sends you.

Read, do not act. Often the account is simply watched for days or weeks. The attacker learns who you deal with, how you write, what transactions are in progress, and which suppliers are expecting payment. This is the research phase that used to be expensive and is now assisted.

Act at the right moment. When a genuine invoice is due, a message goes to your finance contact from your real address, in your writing style, referencing a real transaction, with amended bank details. Every authenticity check passes, because the message genuinely is from you.

This is business email compromise, and it is consistently among the most costly categories of cybercrime, ahead of ransomware in reported financial losses in several years. Notice that no deepfake is required, and no malware. It is one stolen password and patience.

Notice also that the most damaging step, the fraudulent invoice, happens in the recipient's organisation. Their control against it is the second approver from Module 2 and the verification ritual from Module 4, because the message itself is genuinely authentic and no filter will flag it.

❓ Knowledge Check

Why is a compromised email account more serious than a compromised account on most other services?

📚 Flashcards1 / 5

Term

The dissolved perimeter

Click to flip

Definition

Work now lives across many cloud services reachable from anywhere, so the network boundary no longer separates trusted from untrusted. Identity took its place.

Click to flip back

💡Key Takeaway

The wall around the office is gone, so identity is the boundary and attackers mostly log in rather than break in. A valid sign in generates nothing abnormal to detect, which is why credential theft became the dominant technique and why detection alone cannot solve it. Email deserves protection first, because password resets for everything else arrive there, making it the master key. And an attacker who takes a mailbox usually establishes persistence and watches quietly before acting, which is why resetting the password is never the whole response.