// UNCLASSIFIED // CLEARED FOR PUBLIC RELEASE //
FILE PUB-ENTDTG 0600Z
ColdRecon › Techniques › T1078
Technique T1078

Valid Accounts

CLEARED FOR PUBLIC RELEASE · OPEN-SOURCE INTELLIGENCE
Valid Accounts (T1078) — a Initial Access technique, observed in public incident reporting.
MITRE ATT&CKT1078
TacticInitial Access
Incidents on file334

Detection & mitigation

Monitor for unusual browser extension installations and permissions, especially those requesting access to cookies and web requests for enterprise SaaS domains. Implement endpoint detection rules to alert on suspicious cookie access patterns or data exfiltration to unknown external servers. Enforce browser policies to block unauthorized extensions and use session cookie monitoring to detect replay or theft.

Observed in the wild

2026-06-25
valid accounts
Malicious Chrome Extensions Steal Session Cookies from Workday, NetSuite, SAP SuccessFactors
2026-05-20
valid accounts
Compromised @antv npm Packages Used for CI/CD Credential Theft
2026-05-20
valid accounts
GitHub Internal Repositories Breached via Weaponized VS Code Extension
2026-05-13
valid accounts
Entra ID Phantom Device Registration and PRT Bypass Enables Full Tenant Compromise
2026-05-12
valid accounts
Attackers abuse HPE Operations Agent for malware-free intrusion
2026-05-12
valid accounts
Vercel Breach: Lumma Stealer Infects Context.ai, OAuth Tokens Compromise Customer Credentials
2026-05-11
valid accounts
CVE-2026-42869: SOCFortress CoPilot Hardcoded JWT Secret Authentication Bypass
2026-04-28
valid accounts
Checkmarx Supply Chain Breach via Compromised GitHub Repositories
2026-04-20
valid accounts
Vercel security breach originated from employee malware infection via third-party OAuth token compromise
2025-10-23
valid accounts
SK Shieldus Suffers Data Breach via Employee Email Account Compromise
2025-10-07
valid accounts
CVE-2025-37728: Insufficiently Protected Credentials in CrowdStrike Connector
2025-09-02
valid accounts
Palo Alto Networks Salesforce data breach via Salesloft Drift OAuth token compromise
2025-07-29
valid accounts
CISA Advisory on Scattered Spider Cybercriminal Group TTPs
2025-03-31
valid accounts
Check Point Discloses Limited Data Exposure from December 2024 Portal Account Compromise
2025-03-06
valid accounts
Akira ransomware encrypts network shares from compromised webcam to bypass EDR
2025-02-03
valid accounts
BeyondTrust Zero-Day Breach Compromises API Key, Affecting 17 Remote Support SaaS Customers
2024-12-19
valid accounts
BeyondTrust Remote Support SaaS Instances Breached via API Key Compromise and Command Injection Vulnerabilities
2024-09-12
valid accounts
Fortinet Confirms Data Breach Affecting Customer Information
2024-07-30
valid accounts
VMware ESXi Authentication Bypass Vulnerability CVE-2024-37085 Actively Exploited by Ransomware Gangs
2024-07-25
valid accounts
KnowBe4 Hires North Korean Hacker Who Attempts Malware Deployment
2024-07-14
valid accounts
RansomHouse Claims Breach of Trellix Source Code Repositories
2024-06-10
valid accounts
Cylance Confirms Data Breach from Third-Party Platform
2024-06-03
valid accounts
CVE-2024-4332: Tripwire Enterprise Authentication Bypass in REST/SOAP APIs
2024-05-27
valid accounts
Token Protection in Entra ID Conditional Access Bypassed Using Spoofed Device Type
2024-05-09
valid accounts
Zscaler Investigates Claims of Unauthorized Access Sale by IntelBroker

Track this in real time.

ColdRecon watches the public signal so you don't have to — a daily brief and a live detection-coverage desk. Request clearance.

Request Clearance →