Account Takeover Bot

An account takeover bot is used by adversaries to gain unauthorised access to user accounts through automation, giving them the ability to use, manipulate, and/or extract information from the account as though they were the legitimate owner.

Show Techniques

Hide Techniques

Resource Development 3 Tactics

Credential Acquisition

• Data Dumps
• Malware
• Person in the Middle
• Social Engineering

Infrastructure Acquisition

• Botnet
• Command & Control
• Proxies
• Supply Chain Compromise

Tool Development

• Development of Tools
• Testing of Tools
• Campaign Reuse

Reconnaissance 2 Tactics

Specific Target

• Technical Reconnaissance

Loose Target

• Technical Reconnaissance

Defence Bypass 4 Tactics

Mitigation Bypass

• CAPTCHA Farm
• Automated CAPTCHA Bypass
• MFA Bypass
• Token Bypass
• Cookie Abuse
• Credential Pinning

Human Emulation

• User Agent Spoofing
• Device Fingerprint Emulation

Proxying

• Botnet
• User Agent Spoofing
• IP Rotation
• Smurfing

Smokescreening

• Volumetric Traffic Disguise
• Target Diversification

Attack Execution 2 Tactics

Account Takeover

• Credential Cracking
• SSO Compromise

Fake Interaction

• Overlay Attack

Actions on the Objective 1 Tactics

Exfiltration

• Credential Dumping
• Payment Detail Dumping
• PII Dumping

Post-Attack 1 Tactics

Sale

• Information Brokerage
• Automated Sale
• Manual Sale