Identity hijack: why stealing YOU is now the whole attack

The inversion

A decade ago, attackers broke software to reach data. Today they log in as you instead: industry tracking consistently finds that identity-based techniques — stolen credentials, hijacked sessions, abused recovery flows — open more doors than software exploits. The CrowdStrike identity-attack primer puts it plainly: identity is the perimeter now.

The four burglary tools

1. Credential replay. Billions of leaked username/password pairs (see Collection #1) are replayed automatically against email, banking, and shopping logins. Reused passwords make every old breach a live threat.
2. Session and token theft. Infostealer malware skips passwords entirely and steals browser session cookies — logging in as you with no password prompt and no MFA challenge, since the session is already "trusted".
3. MFA fatigue and SIM-adjacent tricks. Floods of approval prompts until you tap "yes" to stop the noise, plus OTP interception via techniques like SIM-swap. MFA can be beaten — the method matters.
4. Recovery-chain hijack. Your email resets your bank; your phone number resets your email. Attackers climb this chain from the weakest link — usually an old, unprotected recovery address.

The lock-down (in order of leverage)

1. Unique passwords + a manager. Kills replay dead. Start with email — the master key to every reset.
2. Phishing-resistant MFA where it counts: authenticator apps at minimum; passkeys/FIDO2 where offered. Move off SMS codes per our SIM-swap guide.
3. Recovery hygiene: a dedicated recovery email with 2FA, a carrier port-out lock, no public DOB/ID photos.
4. Device hygiene: infostealers arrive via cracked software and fake downloads — scan before you install (link scanner), and re-check exposure quarterly (breach check).

You are the credential now. Defend yourself like one.