FBI reports $262 million in losses from account takeover fraud

The FBI reported that more than 5,100 account takeover (ATO) complaints resulting in losses exceeding $262 million were filed since January 2025 ^[1][4].

These losses stem from attackers gaining unauthorized access to financial, payroll, or health savings accounts to steal money or sensitive information ^[4].

FBI reports surge in high-value fraud

According to the FBI, cyber criminals frequently drive these takeovers by impersonating bank support staff ^[1][4]. Using social engineering via texts, calls, and emails, or through fraudulent websites, attackers trick victims into revealing passwords and one-time codes ^[4]. The FBI Internet Crime Complaint Center (IC3) notes that these schemes target individuals, businesses, and organizations of varied sizes across multiple sectors ^[4].

Once attackers gain control, they typically wire funds to criminal-controlled accounts, often linked to cryptocurrency wallets to make the money difficult to trace and recover ^[4]. In nearly all social engineering cases, the attackers change the account password to lock the legitimate owner out ^[4]. For platforms holding balances or prizes—ranging from retail loyalty schemes to sweepstakes services like americanluck.com—the risk of fast cash-out is particularly acute once an account falls ^[1].

Mechanics of credential stuffing and session theft

Attackers rarely rely on guessing passwords, instead buying or harvesting valid credentials and sessions in bulk to test them at scale ^[1]. Verizon research from 2025 found that compromised credentials were the initial access vector in 22% of breaches ^[1].

Credential stuffing—the automated injection of stolen username and password pairs—remains a primary volume engine for these attacks ^[1]. The same Verizon data shows that credential stuffing accounted for a median of 19% of all daily single sign-on (SSO) authentication attempts, peaking at 44% on a single day ^[1].

Beyond passwords, infostealer malware has become a major source of authenticated session cookies ^[1]. Because these stolen cookies allow an attacker to bypass the login page and MFA prompts entirely, password resets alone are often insufficient to close a security incident ^[1]. MITRE tracks this technique as Steal Web Session Cookie (T1539), highlighting that detection must cover the entire session rather than just the initial authentication event ^[1].

Vulnerabilities in federated identity and linked accounts

Flaws in how identity providers (IdP) integrate with other services have enabled large-scale takeovers without the need for passwords. In August 2026, approximately 5,000 Dropbox accounts were compromised due to a flaw in Lenovo's email verification process ^[7].

Attackers registered Lenovo IDs using other people's email addresses and used those IDs to log into associated Dropbox accounts ^[7]. "About 5,000 Dropbox accounts were compromised by the hackers, who accessed files on less than a third of them," said Tim Rathschmidt, a Dropbox spokesperson ^[7]. This affected accounts linked to Lenovo ID that lacked Dropbox's own MFA ^[7]. Reports indicate that files were viewed or downloaded from approximately 1,500 accounts ^[7].

GitLab also patched critical flaws in its identity layer on October 21, 2026 ^[2]. CVE-2026-15723 (CVSS 8.2) allows an authenticated user to take over an LDAP-backed account through unsanitized input during identity linking—the process where two identity sources are joined, usually via email ^[2][6]. Additionally, CVE-2026-112212 (CVSS 7.5) allows unauthenticated users to poison OIDC (OpenID Connect) discovery caches to redirect authentication flows ^[2].

Moving toward phishing-resistant defense

Security guidelines suggest that authentication alone is insufficient because session cookies can be stolen ^[1]. NIST SP 800-63B defines technical requirements for authentication assurance levels (AALs) to establish that a claimant is a previously authenticated subscriber ^[5]. These guidelines require that verifiers (the IdP) and relying parties (the service) be authenticated to claimants to ensure the identity of the services ^[5].

Passkeys are described as phishing-resistant because they bind the credential to a specific legitimate domain ^[1]. This binding prevents proxy sites from using the credentials, unlike SMS or app-based one-time codes which can be relayed by real-time phishing kits, such as the Tycoon 2FA kit ^[1]. To further harden systems, the OWASP Session Management Cheat Sheet recommends setting cookies with Secure, HttpOnly, and appropriate SameSite values, and regenerating session IDs at login and privilege changes ^[1].

What we don't know

• How many GitLab instances were actually exploited via CVE-2026-15723 before the patch was released?
• Which specific regions were affected by the Dropbox-Lenovo account compromises?
• What specific healthcare platform was targeted in the zero-click ATO reported by tushal.io?