thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Account Takeover (ATO)

Unauthorized control of a legitimate user account, typically through stolen credentials or session tokens.

Definition

ATO results from phishing, credential stuffing, SIM swapping, infostealers or session hijacking. Attackers then use the account for fraud, BEC, data theft or lateral movement. Indicators include impossible travel, new MFA device registration, mailbox forwarding rules and unusual login locations.

Example

An attacker logs in from a new country and creates an inbox rule forwarding invoices externally.

Exam tip

New inbox forwarding rules after a suspicious login are a classic ATO indicator in Microsoft 365.

Related terms