FAQ: Stolen Valid Credentials — How Attackers Move Through Your Infrastructure Undetected

TL;DR 380% growth in identity-centric attacks. Attackers steal valid credentials and move through your infrastructure as legitimate users. Your endpoint protection sees nothing because it's legitimate access. Q1: What are "stolen valid credentials"? A : API keys, OAuth tokens, session cookies, or database passwords that attackers obtain and use to authenticate to your systems as if they were authorized users. Examples : AWS access key (attacker logs in as that user) GitHub personal access token (attacker clones private repos) Okta session cookie (attacker logs into your SaaS admin portal) Database password (attacker queries your database) Stripe API key (attacker queries customer payment data) Key difference from malware : Malware = attacker plants malicious code Stolen credentials = attacker uses legitimate access Q2: How is this different from a password breach? A : Two critical differences: Traditional Password Breach Attacker steals password hash from database Attacker cracks hash