Identity-Based Endpoint Attacks After Credential Compromise

Most small businesses picture a breach as someone forcing their way through a firewall. The reality is quieter. Attackers now log in with credentials that already work, and the endpoint becomes their operating base.

Why attackers stopped needing to break in

The dominant intrusion method today is not exploitation. It is authentication. Attackers sign in with stolen credentials rather than breaking through defenses, and that shift changes what a breach actually looks like inside your environment. Malware-free intrusions now account for nearly all detected breaches. If an attacker has valid credentials, the initial access looks just like a legitimate login.

Traditional security monitoring is calibrated to catch malware signals. File hashes, process anomalies, network signatures. None of those appear when the attacker is authenticated. The tools are looking for the wrong thing entirely.

The attacker looks exactly like an employee because they are using an employee's credentials. That forces a fundamental change in what detection must ask. The question is no longer whether a credential is valid. It is whether the behavior makes sense.

There is a common objection here: we have MFA, so this does not apply to us. Session token hijacking bypasses MFA entirely. The token represents an already-authenticated session, so no MFA challenge is triggered. The login happened days or weeks ago. The attacker is simply reusing it.

How credentials reach attackers before anyone notices

SpyCloud's 2026 Identity Exposure Report recaptured tens of billions of distinct identity records in its datalake from the criminal underground. That is a 23% increase year over year. The volume reflects a fundamental shift in the supply of usable credentials available to attackers. None of this is hypothetical.

Three primary pipelines feed that supply. Your company's users are about as likely to be targeted as anyone else, because phishing campaigns split roughly evenly between consumer and corporate victims. Infostealer malware infections harvest browser-stored passwords and session cookies directly from endpoints. Data breaches dump credentials from services your employees use every day.

The infostealer finding deserves attention. SpyCloud found that 40% of infostealer infections occurred on endpoints that already had EDR or antivirus tools installed. Traditional endpoint defenses do not reliably prevent credential theft. The malware runs, grabs what it needs, and is gone before the signature-based tools notice.

Session cookies numbered in the billions among the recaptured records. These represent already-authenticated sessions, and they bypass MFA because the authentication already happened. The attacker is not logging in as you. They are resuming the session you already started.

Non-human identities are now a primary target alongside human ones. Third-party application credentials were exposed at scale, with a dramatic year-over-year increase. API keys and tokens appeared in the millions. AI tools themselves have become a credential target. SpyCloud recaptured millions of authentication cookies and credentials specifically for AI tools. Most security programs have not yet accounted for that surface.

Once credentials enter the criminal underground, they circulate and get repackaged. One set of credentials may be sold, reused across campaigns, and tested against systems far from where they were stolen. Password reuse across production and non-production environments multiplies the blast radius. Shared or legacy accounts do the same. A single stolen credential becomes a key that gets tried against every door your organization has ever left unlocked.

What a compromised credential actually gives an attacker inside your environment

A single stolen credential does not give an attacker one account. It gives them every permission, trust relationship, and cached access that identity carries across the environment. The identity is a highway, not a door. Once inside, an attacker can advance, cross boundaries, and reach critical assets through legitimate authenticated sessions. No exploit is required at any subsequent step.

Consider what standard platform behavior alone can expose. A cached access key on a single Windows machine, stored there by default, no misconfiguration involved, could have opened a path to nearly all entities in a company's cloud environment. The exposure was caught before an attacker used it. That is not a story about a careless employee. It is a story about how identities accumulate access by simply being used.

Permissions chain into attack paths in predictable ways. A single Active Directory group membership that no one reviewed gives an attacker on a low-value endpoint a direct path to the corporate domain. A developer SSO role provisioned for a completed cloud migration project retains its permissions long after the project closes. Anyone who compromises that identity can move from developer access to production admin in several steps. Over-scoped roles, inherited permissions, and unretired legacy grants create repeatable paths to higher privilege. The attacker never needs novel tooling. Once an attacker can write to IAM, they can often escalate quickly. The attack path runs through the environment's own legitimate permission structure.

Non-human identities amplify this problem. AI agents operate with the permissions of the user or service account that spawned them. If an agent is compromised or manipulated, it can act at whatever access level the identity layer has granted it, often without human review. The agent is not the threat. The permission it inherited is.

Palo Alto's 2025 incident response investigations put numbers on the pattern. Identity weaknesses played a serious role in nearly all cases reviewed. Over nine in ten breaches were enabled by preventable gaps, misconfigurations, inconsistent controls, limited visibility, or excessive identity trust. The attackers are not winning because they are sophisticated. They are winning because identity governance is loose.

The step-by-step path from first login to lateral movement and persistence

Credential compromise follows a predictable sequence. Each stage has a corresponding point where a defense can hold or fail. Non-security teams can learn to recognize these stages, and that recognition is the first step toward knowing where to intervene.

Stage one is initial access. The attacker authenticates with stolen credentials or a hijacked session token. The login looks legitimate. No malware is involved. No alerts fire on traditional monitoring. This is where the breach begins, and it is nearly always invisible to the tools most companies rely on.

Stage two is reconnaissance and credential harvesting. With the initial foothold, the attacker dumps and cracks additional passwords, identifies high-privilege accounts, reads secrets, and maps the environment. All of this happens through authenticated sessions. Nothing looks unusual because nothing requires unusual access.

Stage three is lateral movement. With compromised credentials, the attacker can access internal services and pivot to higher-privilege accounts. Federated access makes this faster. One compromised identity provider account reaches every downstream application connected to it. Slack, AWS, GitHub, and every other integrated service, all at once.

Stage four is privilege escalation. The attacker exploits over-scoped roles, inherited permissions, and forgotten legacy access grants to reach administrative control. In cloud environments, writing to IAM can complete this step. No novel tooling is required.

Stage five is persistence. The attacker adds their own controlled credentials, API keys, or backdoors. Even if the original stolen credential is rotated, access is retained. At the CI/CD pipeline level, backdoors injected here affect every downstream system that consumes that pipeline's output. The attacker is no longer dependent on the original compromise.

Stage six is execution of objective. Data exfiltration, ransomware deployment, supply chain compromise, or long-term intelligence gathering. The objective varies by actor type. The preceding stages are nearly identical across all of them.

Speed matters. The 2025 attack cycle has compressed dramatically. Lateral movement from initial access to significant escalation can now occur within minutes in the fastest observed cases. Storm-2949 showed what this looks like at cloud scale. Microsoft's investigation found that a single identity compromise opened a path to SharePoint, OneDrive, Azure App Service, Key Vault, Storage, SQL databases, and virtual machines. The stages are not theoretical. They are a playbook that has already run, end to end.

Why the attack chain is so hard to detect without unified visibility

The reason credential-based attacks go undetected for so long is not that defenders lack tools. It is that the tools they have were built to catch different problems and cannot see how identity exposures chain together across environments. IGA platforms manage user lifecycle in isolation. PAM solutions vault privileged credentials and monitor sessions. Modern platforms integrate with IGA, SIEM, and other identity tools, but the integration is partial. Neither can map how identity exposures chain together across endpoints, Active Directory, and cloud environments into a single exploitable route.

The consequence of that gap is measured in time. Credential-based breaches carry one of the longest detection-and-containment lifecycles of any attack type. An attacker can operate invisibly for the better part of a year in an environment with no unified monitoring. That is not a failure of effort. It is a structural limitation of how the tools were designed.

The infostealer-to-ransomware pipeline makes detection timing critical. Among ransomware victims with a prior credential leak, the credential event typically preceded the ransomware attack by days, commonly under 48 hours. Dwell time can extend to weeks or months in some cases, but the fast cases leave almost no room to react. That window is where detection would have broken the chain.

The TeamPCP CI/CD supply-chain cascade in March 2026 illustrates what happens when detection fails at the first link. Each wave of the attack used credentials stolen in the previous one. A single incomplete credential rotation transformed into a multi-vendor incident affecting AI infrastructure, cloud security tooling, and the npm ecosystem simultaneously. One missed rotation. Three ecosystems.

Fragmented tooling creates handoff gaps. The identity tool sees the credential. The endpoint tool sees the behavior. Neither flags the combined pattern as an attack path. The signal exists. It is just split across systems that do not talk to each other. You are not being blamed for having the wrong tools. The tool architecture most organizations inherited was never designed for this threat pattern.

Where defenses actually need to hold for a company without a security team

For a company without a dedicated security team, the goal is not to detect every stage of the attack chain in real time. It is to eliminate the conditions that make lateral movement and persistence possible in the first place. The most important control is removing the identity conditions that create attack paths before an attacker arrives.

Phishing-resistant authentication removes the password as a viable target. FIDO2 and WebAuthn hardware keys and passkeys eliminate the largest single source of credential theft. Session token hijacking can still occur, but it closes the biggest door. Session token hardening matters next. Short-lived tokens, device binding, and monitoring for the same token used from multiple IPs close the MFA bypass that token theft enables.

Access scope discipline is the quiet work that prevents most escalation. Retire permissions when projects end. Review group memberships. Avoid shared accounts. These practices remove the over-scoped roles and forgotten legacy grants that create the attack paths described throughout this piece. Monitoring for behavioral anomalies rather than credential validity separates detection from non-detection. Impossible travel, authentication from unexpected locations, lateral access patterns. The credential will look valid. The behavior will not.

Here is the structural problem for SMBs. These controls span device management, identity, and endpoint behavior, and they only work when they share context with each other. A company running separate tools for each recreates the fragmentation gap that makes attacks invisible. The tools exist. The integration is what is missing.

The credential-compromise problem is a standing condition for most SMBs, not a future risk. A 2026 Guardz telemetry report on SMB credential exposure found that 89% of SMBs have at least one user with a confirmed credential compromise at any given point in time. The priority is not preparation for a hypothetical breach. It is closing the identity exposure paths that exist right now. Zip brings device management, endpoint security, identity protection, and compliance automation into a single platform that deploys quickly. It was built specifically so founders, IT generalists, and operations leaders can enforce these controls without building a security program from scratch.