Account Takeovers Still Outrunning Detection, Vendors Push Behavioral AI as Answer

Key points

• Initial access brokers sell credential sets for as little as $10 on Russian-language forums
• Behavioral AI claims to flag hostile sessions even when credentials, device posture and MFA tokens all check out
• Scattered Spider's 2023 intrusions at MGM and Caesars began with social-engineered account takeovers, not exploits
• The vendor case for behavioral detection rests largely on vendor-published numbers
• Buyers should demand false-positive rates and dwell-time data before committing

Account takeover is the workhorse of the criminal economy. Initial access brokers sell credentials for as little as $10 a set on Russian-language forums, and ransomware affiliates buy them by the bundle. The attack doesn't require malware. It requires a working password.

That's the problem a forthcoming industry webinar is pitching to solve, and it's worth examining the argument on its merits.

What does behavioral AI actually claim to do?

The pitch: behavioral AI, applied to identity telemetry, can flag a logged-in session as hostile even when the credentials, device fingerprint and MFA token all check out. Static rules can't. Conditional access policies built around geography and device posture are routinely bypassed by attackers using residential proxies and session-cookie theft. Our 19 June story "Device Code Phishing Is Eating MFA. Behavioral Detection Is the Backstop." found that token theft and consent-grant abuse sidestep the second factor entirely, leaving anomaly detection as the last line.

The operational case is hard to argue with. Scattered Spider, the loose collective tied to the MGM and Caesars intrusions in 2023, ran almost entirely on social-engineered account takeovers. Caesars reportedly paid a ransom. MGM refused and absorbed major losses running into nine figures. Neither incident began with an exploit. Both began with a help desk and a phone call.

Does this pattern extend beyond one group?

It does. LockBit affiliates, before the February 2024 NCA-led takedown, leaned heavily on valid accounts purchased from brokers. ALPHV/BlackCat operated the same way. Cl0p's MOVEit campaign was the outlier, not the norm. We've tracked the credential broker ecosystem across six stories since 4 June, including how underground services now sell targeted lookups against stolen credential corpora, lowering the bar further.

What behavioral systems claim to catch is the after-login drift: unusual mailbox rule creation, OAuth grants to obscure third-party apps, sudden interest in finance shared drives from an engineering account. MITRE ATT&CK catalogs valid-account abuse and the related persistence techniques, and defenders consistently rate them the hardest to detect.

Should you worry about alert fatigue?

Yes, and that's the skeptical read. "Behavioral AI" has been a vendor slogan for a decade. Anomaly detection generates alerts. Alerts generate fatigue. Fatigue generates ignored alerts. Whether the current generation of large-model-assisted tooling actually moves the needle on mean-time-to-detect for account takeover is an open empirical question, and most published numbers come from the vendors themselves. We noted the same dynamic in our 23 June piece on email security teams buried in alerts.

What isn't in dispute is the demand side. Microsoft's most recent Digital Defense Report put identity-based attacks at hundreds of millions per day across its tenants. CISA advisories on state-sponsored intrusion clusters have centered on token theft and account abuse rather than novel exploits.

The webinar audience has a real problem. Whether the proposed answer is the right one is separate, and buyers should put it to vendors directly: show the false-positive rate, show the dwell-time delta, show the customer who refused to pay because detection fired in time.

Anything short of that is marketing.