Broken API authentication and token abuse
An adversary bypasses login, password recovery, or token validation and assumes the identity of a user or service.
Malware and Command and Control
Malicious code executes, maintains access, and communicates with adversary infrastructure through common or covert channels.
Session and access-token hijacking
An adversary steals a cookie, OAuth token, or another session artifact and accesses a service without re-entering a password or MFA.
Credential theft
An adversary obtains passwords, tokens, sessions, or other authentication material and uses it to expand access.
Cloud and SaaS compromise
An adversary abuses cloud identities, permissions, configurations, or application integrations to access services and data.