How AI Is Accelerating Credential Theft
On September 8, Google's Threat Intelligence Group reported that attackers used a multi-agent AI system to break into an organization's cloud infrastructure.
According to the report, the entire operation took less than six hours and resulted in thousands of stolen third-party credentials, with very little human involvement needed.
The AI reportedly handled several tasks on its own: scanning for vulnerabilities, fixing problems as they came up, and rotating IP addresses to avoid detection.
Microsoft reported that AI-assisted phishing campaigns achieved click-through rates as high as 54%, compared to around 12% for traditional phishing emails.
According to Verizon, stolen credentials play a role in nearly 45% of all data breaches studied. Unit 42 found that identity-related weaknesses were a factor in 89% of the incidents they investigated.
Security firms like Specops argue that a correct password is no longer enough to tell legitimate access apart from misuse — the device being used also needs to be checked.
It remains unclear how widespread these automated attacks already are and how well organizations are currently prepared to defend against them.
WHY IT MATTERS
AI is making it faster and easier for attackers to use stolen passwords at scale, raising the risk for anyone with weak or reused passwords.
WHAT YOU CAN DO NOW
- Use a different password for each account Set a unique password for every website so that one stolen password doesn't put multiple accounts at risk. A password manager can remember these different passwords for you.
- Turn on two-factor login Enable two-factor authentication for important accounts like email and banking. This way, a stolen password alone isn't enough for someone to log in as you.
- Be cautious with login requests Don't click links in emails or messages that ask you to enter your password right away. Instead, open the website directly in your browser and log in there.
- Check if your data has already leaked Use a free service like haveibeenpwned.com to see if your email address has appeared in known data breaches. If it has, change that password immediately.