Common Identity-Based Attacks, and How to Stop Them

What is an identity-based attack?

An identity-based attack is a cyberattack that targets credentials and authentication, usernames, passwords, password hashes, Kerberos tickets, and session tokens, to gain access to systems and data as a legitimate user. The attacker does not exploit a software vulnerability. They become a valid account, which lets their activity blend into normal operations. This is what makes identity attacks both effective and hard to detect: there is no malicious file to quarantine, only a login that looks real.

Identity has become one of the primaries attack surface for a simple reason. As applications and data moved to the cloud and SaaS, the network perimeter dissolved, and the login page became the new front door. Attackers followed. The defenses that follow have to match how these attacks actually work, so it helps to know the common types.

The most common identity-based attacks

Most identity compromises come from a recognizable set of techniques. They are often chained together, one for initial access, another for lateral movement, a third for persistence, so defending against a single type is never enough.

Phishing and social engineering

Still the most common entry point, because it targets the person, not the system. A phishing email or fake login page harvests the password directly from the user. Modern campaigns go further with real-time proxy pages that relay the victim's credentials and one-time code to the attacker as they type, and with social engineering by phone, the help-desk caller who talks an agent into resetting a password or registering a new authentication device. CrowdStrike's 2026 reporting recorded a sharp rise in fake CAPTCHA lures, a technique that walks the victim into running attacker commands themselves.

Credential stuffing and password spraying

Both are large-scale guessing attacks that differ in direction. Credential stuffing replays username and password pairs leaked in earlier breaches, betting that people reuse passwords across sites. Password spraying tries a few common passwords against many accounts at once to avoid lockouts. Both specifically hunt for accounts that lack multi-factor authentication, and there are more of those than most organizations think: workforce MFA adoption reached about 70 percent in Okta's 2025 data, which means roughly one in three users still has no MFA protection at all.

MFA fatigue

When an attacker already has a valid username and password, MFA fatigue, also called push bombing, exploits the approval mechanic in authenticator apps. The attacker triggers login attempts repeatedly, sending a stream of push notifications until the target approves one simply to stop the interruption, especially off-hours. It is a low-tech attack against a human reflex, and it has grown fast: MFA-fatigue attacks rose 217 percent year over year in Verizon's 2025 reporting.

Adversary-in-the-middle and session-token theft

This is the most important shift in how attacks defeat MFA. Instead of a fake login page that captures a password to replay later, the attacker places an invisible proxy between the user and the real site. The victim sees the genuine Microsoft or Google login page, enters their real password, and completes the real MFA challenge, and every interaction is relayed through attacker infrastructure. The attacker steals the entire authenticated session, password, MFA result, and session cookie, in real time. Frameworks that do this, such as Evilginx2, are now sold as subscription services, which is why token theft has moved from advanced to routine.

Directory and ticket attacks

Once inside a Windows environment, attackers target the directory itself. Pass-the-hash reuses a stolen password hash without ever cracking it. Kerberoasting requests and cracks service-account tickets offline. Golden Ticket and Silver Ticket attacks forge Kerberos tickets to impersonate any user and persist with near-total control. These techniques turn a single foothold into domain dominance, and they are a core reason service-account and directory hardening matters.

Why authentication alone no longer stops them

The uncomfortable pattern across Cloudfare`s 2026 threat landscape is that the most dangerous identity attacks bypass authentication rather than break it. Adversary-in-the-middle proxies intercept sessions after MFA completes. Consent phishing abuses OAuth grants that no MFA challenge governs. Credential stuffing enumerates which accounts lack MFA before any login is attempted. Multi-factor authentication remains essential, it stops a large share of straightforward account takeovers, but it is a control at the point of entry, not a perimeter, and attackers have industrialized ways around it.

That is the core lesson: single, static controls applied to a dynamic, distributed attack surface will always leave gaps. The gap is usually not in any one control. It is in visibility.

How to defend against identity-based attacks

Effective defense is layered, because no single control covers every technique.

• Start with phishing-resistant multi-factor authentication. FIDO2 security keys and passkeys cannot be phished, replayed, or relayed by an adversary-in-the-middle proxy, and they neutralize MFA fatigue because there is no push to approve. Prioritize them over SMS or push-based one-time codes, and close enrollment gaps, since unenrolled accounts are exactly what attackers hunt for.
• Add device trust and risk-based authentication, so that stolen credentials on an unmanaged device, or a login from an anomalous location or time, are challenged or blocked before access is granted. Enforce least privilege and zero-trust verification, so that a single compromised credential cannot become domain dominance, and so lateral movement has fewer paths to follow. Harden the directory and service accounts against pass-the-hash and ticket attacks.
• Then, because prevention is never complete, detect on identity behavior rather than file signatures. The question shifts from "is this login valid?" to "is this identity behaving normally?" A credential authenticating from an impossible location, a service account reaching resources it has never touched, a user escalating privilege at an unusual hour, these are the signals that a valid identity has been taken over, and they are invisible to tools that only inspect the login itself.

Where posture and detection come in

These defenses fall into two disciplines. Identity Security Posture Management (ISPM) reduces the attack surface in advance, closing MFA gaps, removing over-privilege, and hardening the paths attackers reuse. Identity Threat Detection and Response (ITDR) catches the attack in progress by watching identity behavior. Together they cover both the prevention and the detection that identity attacks demand. For the fuller picture, see the identity attack lifecycle.

How 8layers helps

Octagon, the posture module of the 8Layers platform, surfaces the weaknesses these attacks exploit, identities missing MFA, over-privileged and dormant accounts, and risky federation paths, and scores them by real impact so the most dangerous gaps get closed first. Thor, the detection module, correlates login and behavioral signals across every identity provider to catch account takeover, MFA-fatigue approval, privilege escalation, and lateral movement in real time, with a full timeline and direct response actions in one workspace.

Because they share an identity data layer, a Thor detection on an identity already flagged by Octagon as high-risk is treated with the urgency it deserves, rather than as one more undifferentiated alert.

If you want to see which identity attacks your environment is currently exposed to, book a demo.

Frequently asked questions

What is the most common identity-based attack?

Phishing and social engineering remain the most common entry point, because they target the user rather than a software flaw. Modern phishing often uses real-time proxy pages that defeat basic multi-factor authentication by relaying the victim's credentials and one-time code as they are entered. Credential stuffing and password spraying are also extremely common, especially against accounts without MFA.

Does MFA stop identity-based attacks?

MFA stops many straightforward account takeovers and is essential, but it is not sufficient on its own. Adversary-in-the-middle proxies steal the authenticated session after MFA completes, MFA-fatigue attacks trick users into approving fraudulent prompts, and consent phishing abuses OAuth grants that MFA does not govern. Phishing-resistant MFA (FIDO2 and passkeys) closes most of these gaps, but layered defense and behavioral detection are still needed.

What is an adversary-in-the-middle attack?

An adversary-in-the-middle (AiTM) attack places an invisible proxy between the user and the real login site. The victim sees the genuine login page and completes real authentication, including MFA, while the attacker relays every interaction and steals the resulting session token in real time. Because the stolen session is already authenticated, the attacker bypasses MFA entirely. Tools like Evilginx2 have made this attack widely available.

What is MFA fatigue?

MFA fatigue, or push bombing, is an attack where someone who already has a valid password triggers repeated login attempts, flooding the target with authenticator push notifications until they approve one to stop the interruption. It exploits human reflex rather than a technical flaw. Phishing-resistant methods like FIDO2 keys and passkeys defeat it because there is no push prompt to approve.

How do you detect identity-based attacks?

By monitoring identity behavior rather than looking for malware. Since these attacks use valid credentials, the signals are behavioral: authentication from an unusual location or device, privilege escalation, access to resources an identity never normally touches, or a new authentication factor being registered. Identity Threat Detection and Response (ITDR) tools are built to correlate these signals and surface an attack in progress.