Attackers Are Logging In, Not Breaking In
AI has cut the time between a stolen password and a full-blown intrusion. The fix isn't another login screen, it's checking the device too.
Key points
- Palo Alto Networks' Unit 42 says identity weaknesses played a role in almost 90% of the incidents its responders investigated, making a stolen login the single most reliable way into a company today.
- Unit 42 also found that the fastest data theft speeds quadrupled in 2025, meaning attackers now empty systems in hours, not days.
- Microsoft's April 2026 threat briefing says criminals are now using AI across the whole attack, from research to writing convincing phishing emails to sorting through stolen files.
- Defenders are being told to stop trusting a correct password and instead check the device asking for access, a shift the industry calls device-trust or continuous verification.
The old picture of a hacker forcing a lock is out of date. In 2026 the criminal walks up to the front door with a working key, and an AI helper is increasingly the one that cut it.
That's the honest takeaway from two pieces of primary research landing this spring. Palo Alto Networks' Unit 42 incident response team found that identity problems, meaning stolen passwords or hijacked session cookies, featured in almost 90% of the breaches it was called in to clean up. Microsoft's security team, in its April 2026 briefing from RSAC, says AI is now baked into how attacks are planned and run, not a novelty on the side. We've been tracking Unit 42's research since its first appearance in our coverage on 26 June 2026, and this report is the starkest thing they've published.
What has actually changed?
Speed and polish. Unit 42 measured the fastest data-theft cases in 2025 running four times quicker than the year before, with some intrusions moving from first login to stolen files in a matter of hours.
AI is the reason. Criminals use it to draft phishing emails, fake messages designed to trick staff into typing their password into a lookalike site, in fluent local language. They also use it to sift through stolen mailboxes and surface the useful bits. Microsoft is clear that a human is still steering, but the grunt work is now automated.
How are the criminals getting in?
By signing in. The dominant pattern Unit 42 describes is attackers buying or phishing a valid username and password, then using it against a company's cloud email or single sign-on portal.
Where multi-factor authentication, the second check that sends a code to your phone or prompts an app, is missing, they walk straight in. Where it is present, they steal the session cookie after you've logged in, which lets them skip the second check entirely. The OAuth 2.0 spec was never designed on the assumption that the browser holding your token would be quietly copied by an infostealer.
What should ordinary readers do?
Turn on multi-factor authentication everywhere it's offered, and prefer a passkey or an authenticator app over a text message. If your employer offers a hardware security key, use it. Change any password you've reused across sites, because that's exactly the raw material feeding these attacks. Our story on the N0va phishing kit from 17 September shows how quickly a working credential becomes an open door.
The device is now part of the login
Vendor thinking has shifted, flagged in coverage by BleepingComputer of a Specops writeup, toward a position where a correct password and a correct one-time code are no longer enough proof. The device asking for access has to be known and healthy too: patched and actually belonging to the person named on the account.
Having watched IAM vendors pitch this idea for five years, my read is that the market finally has the incident data to justify it. When 9 out of 10 breach investigations trace back to a login, you can't keep pretending the login is the finish line. It's the start.
| Finding | Figure | Source |
|---|---|---|
| Breaches involving identity weakness | ~90% | Unit 42, 2026 |
| Increase in fastest exfiltration speed | 4x in 2025 | Unit 42, 2026 |
Common questions
Is AI actually running these attacks on its own?
No. Both Microsoft and Unit 42 say a human is still in the loop making decisions. AI is handling the writing, translating and sorting that used to slow criminals down.
Does multi-factor authentication still help?
Yes, a lot, especially phishing-resistant kinds like passkeys and hardware keys. It doesn't stop every attack, because session-cookie theft can bypass it, but it removes the easiest routes in.
