// UNCLASSIFIED // CLEARED FOR PUBLIC RELEASE //
FILE PUB-ENTDTG 0600Z
ColdRecon › Techniques › T1078
Technique T1078

Valid Accounts

CLEARED FOR PUBLIC RELEASE · OPEN-SOURCE INTELLIGENCE
Valid Accounts (T1078) — a Initial Access technique, observed in public incident reporting.
MITRE ATT&CKT1078
TacticInitial Access
Incidents on file407

Detection & mitigation

Monitor endpoints for unauthorized proxyware installations (e.g., Peer2Profit, AstroProxy) via EDR application inventory and software restriction policies. Detect unusual outbound connections to residential proxy networks and block known proxyware domains/IPs. Educate users on risks of installing unapproved software.

Observed in the wild

2026-08-21
valid accounts
Peer2Profit Turns Employee Devices Into AstroProxy Nodes That Can Expose Internal Networks
2026-08-13
valid accounts
AmnesiaStealer Hijacks Chromium Sessions to Give Attackers Live Browser Control on macOS
2026-08-11
valid accounts
New Abyssos RAT Combines Credential Theft, Browser Session Hijacking, and Hidden VNC Access
2026-08-10
valid accounts
Sophos Reports Interlock Ransomware Exploits Unprotected Endpoints for Credential Theft
2026-08-09
valid accounts
Hackers compromise Mexican company printer to demand $3,000 ransom
2026-08-05
valid accounts
EtherRAT Malware Spreads via Remote Scheduled Tasks Across Windows Domains
2026-08-04
valid accounts
CaptiveCrunch Campaign Uses ChocoShell Infostealer to Steal Microsoft 365 Tokens
2026-08-03
valid accounts
Pass the Passkey: Attack Exploits Missing User Verification in Passkey Implementations
2026-08-02
valid accounts
Attackers Exploit N-able N-central Authentication Bypass to Access Managed Endpoints
2026-06-25
valid accounts
Malicious Chrome Extensions Steal Session Cookies from Workday, NetSuite, SAP SuccessFactors
2026-05-20
valid accounts
Compromised @antv npm Packages Used for CI/CD Credential Theft
2026-05-20
valid accounts
GitHub Internal Repositories Breached via Weaponized VS Code Extension
2026-05-13
valid accounts
Entra ID Phantom Device Registration and PRT Bypass Enables Full Tenant Compromise
2026-05-12
valid accounts
Attackers abuse HPE Operations Agent for malware-free intrusion
2026-05-12
valid accounts
Vercel Breach: Lumma Stealer Infects Context.ai, OAuth Tokens Compromise Customer Credentials
2026-05-11
valid accounts
CVE-2026-42869: SOCFortress CoPilot Hardcoded JWT Secret Authentication Bypass
2026-04-28
valid accounts
Checkmarx Supply Chain Breach via Compromised GitHub Repositories
2026-04-20
valid accounts
Vercel security breach originated from employee malware infection via third-party OAuth token compromise
2025-10-23
valid accounts
SK Shieldus Suffers Data Breach via Employee Email Account Compromise
2025-10-07
valid accounts
CVE-2025-37728: Insufficiently Protected Credentials in CrowdStrike Connector
2025-09-02
valid accounts
Palo Alto Networks Salesforce data breach via Salesloft Drift OAuth token compromise
2025-07-29
valid accounts
CISA Advisory on Scattered Spider Cybercriminal Group TTPs
2025-03-31
valid accounts
Check Point Discloses Limited Data Exposure from December 2024 Portal Account Compromise
2025-03-06
valid accounts
Akira ransomware encrypts network shares from compromised webcam to bypass EDR
2025-02-03
valid accounts
BeyondTrust Zero-Day Breach Compromises API Key, Affecting 17 Remote Support SaaS Customers

Track this in real time.

ColdRecon watches the public signal so you don't have to — a daily brief and a live detection-coverage desk. Request clearance.

Request Clearance →