The Attack Patterns Hiding Inside Logins That Look Completely Normal

The last post in this series covered why account takeover is hard to catch: the login itself looks legitimate. This one is about what's actually happening behind that login. "Account takeover" isn't one attack. It's a category, and the individual patterns inside it look different enough that a defense built for one often misses the rest.

Credential stuffing

Attackers take a list of usernames and passwords leaked from an unrelated breach and try them against a different service, betting that people reuse passwords. Most attempts fail. At scale, enough succeed to matter, and the traffic pattern (thousands of rapid login attempts across many accounts, often from a narrow range of IPs) is one of the more detectable signatures in this list, if anything is actually watching for it.

Brute force

The blunter cousin of credential stuffing: guessing passwords for a single account rather than testing known credentials across many. Slower and noisier, but still effective against weak or reused passwords, especially without rate limiting or lockout policies in place.

Session hijacking

Instead of stealing a password, the attacker steals an active session, often via a token pulled from malware, a leaked cookie, or a man-in-the-middle attack on an unsecured connection. There's no login event to flag at all, because the attacker never had to log in. They just took over a session that was already open.

A subtler variant: the same session or credentials show up active on devices and locations that don't fit any pattern a single legitimate user would produce. Not every instance is malicious (a household sharing a streaming account is a different problem than a stolen banking credential), but the signal is worth watching, especially on accounts that should only ever have one real user behind them.

Impossible travel

An account logs in from Chicago, then from Singapore twelve minutes later. No commercial flight makes that trip, so either the account has two active users in two places, or one of those two logins isn't the real account holder. This is one of the easier patterns to detect automatically and one of the more reliable ones, because the underlying math (geography and time) doesn't require guessing at intent.

MFA flooding

Attackers who already have a valid password but not the second factor start spamming push-based MFA approval requests, hoping the account holder eventually taps "approve" out of annoyance or confusion rather than suspicion. It's a social engineering attack wearing a technical disguise, and it's grown common enough that some organizations now flag repeated MFA prompts as a signal on their own, independent of whether one eventually gets approved.

Stolen credential usage and suspicious infrastructure

Logins from known malicious IP ranges, Tor exit nodes, or hosting providers associated with automated attack tooling rather than real user traffic. None of these alone prove an account is compromised, but they raise the baseline risk of a login enough to warrant a closer look or an extra verification step.

Insider threats

The pattern that doesn't fit the "outside attacker" framing at all: a legitimate user, with legitimate credentials, accessing things outside their normal scope of work. Insider threats are the hardest of these to catch precisely because nothing about the login itself is wrong. The only signal available is behavioral: does this access pattern match what this person actually does day to day.

None of these patterns look alike, and none of them show up as an obviously broken login on their own. What they share is that each one becomes visible only when it's compared against a baseline of what normal looks like for that specific account. That's the actual engineering problem behind account takeover prevention, and it's what the next post in this series gets into.