Skip to content
Irregularpedia Logo Irregularpedia

Account Takeover

Account Takeover

Section titled “Account Takeover”

Account takeover (ATO) is when an adversary gains control of an account you already own. Unlike credential theft (which yields the password), ATO often bypasses the password entirely — by hijacking a session token, registering a new device, swapping a phone number, or abusing a “recovery” path.

Pages in this section

Section titled “Pages in this section”
  • SIM Swap — Adversary social-engineers a carrier into porting your number to their SIM, then resets every SMS-protected account. Prevention, indicators, and rapid response.

Sub-vectors (planned)

Section titled “Sub-vectors (planned)”
  • Linked-device abuse — see the Signal/RIS campaign for the canonical CMA example.
  • OAuth consent phishing — tricking the victim into authorizing a malicious OAuth app. Bypasses passwords AND MFA.
  • Session-token theft — infostealer malware dumps browser cookies; attacker imports them and is logged in as you with no further auth.
  • Adversary-in-the-Middle (AitM) proxies — Evilginx-style reverse proxies that capture both credentials and live MFA tokens.
  • Email-as-recovery hijack — compromising the email tied to “forgot password” for many accounts.
Section titled “Related”