An attack where a threat actor gains access to a legitimate cloud account and uses it to move laterally or exfiltrate data.
Why it matters:
- Hard to detect because attackers use real credentials.
- Often leads to business email compromise, data theft, or cloud resource manipulation.
Pro tip: Monitor for unusual login locations, device changes, or impossible travel.
« Back to Glossary Index