Last year identity-based threats rose to the top of the enterprise risk landscape. Push Security’s latest findings highlight a stark truth: attackers are shifting strategies, and legacy defenses are no longer holding the line. What does that mean for the future?
In 2019 we saw work from home increase drastically causing many IT teams to rethink how exactly they can secure their companies. Fast forward to 2024, with remote work now the norm and SaaS usage exploding, the old idea of a secure network boundary has collapsed. Most day-to-day work happens in browsers, across dozens (if not hundreds) of cloud apps. Oversight is fragmented, and security teams are often in the dark.
Push’s research shows identity isn’t just another attack vector anymore it’s the main one. The rise of decentralized identity systems, inconsistent controls, and overlapping providers has opened the door for attackers. Misconfigured services, forgotten user accounts, and password reuse are being exploited daily.
Of all the incidents last year, none hit harder than the breach affecting around 165 Snowflake customers. The attackers used credentials stolen by infostealer malware some going back to 2020 to log in without triggering MFA. These long-forgotten, still-valid passwords became skeleton keys for accessing customer data.
In many cases, the attackers didn’t need to hack anything they simply logged in and ran SQL queries to extract sensitive information. The fallout was massive, sparking debates about shared responsibility, software supply chains, and the future of authentication.
The playbook has evolved. Phishing tools capable of defeating MFA are now commonplace, thanks to tactics like Adversary-in-the-Middle (AitM) attacks. Tools such as Evilginx can intercept tokens in real-time, silently hijacking sessions.
Meanwhile, infostealer malware like RedLine and Raccoon spreads through fake ads, shady downloads, and poisoned GitHub repos. These programs quietly lift credentials, cookies, and even screenshots feeding a booming underground market.
Session hijacking has also grown more efficient. Instead of stealing passwords, attackers steal session cookies, which can give them instant access without MFA. Many cookies remain valid for days or weeks, offering plenty of time for exploitation.
Several threat actors stood out in 2024:
MFA and SSO are widely adopted, but Push’s findings make clear that they’re far from foolproof:
Even though just 1% of breached credentials are still valid, attackers operate at such a scale that they only need one hit to succeed. It’s a volume game.
Push’s report closes with a clear warning: as cloud adoption deepens and attackers refine their methods, identity will remain the primary battleground. It’s no longer just a means of access it’s the attack surface itself.
To counter these threats, organizations need to invest in Identity Threat Detection & Response (ITDR). That means:
In 2024, identity moved from being a point of concern to the very heart of the breach. As cyber threats grow more agile and sophisticated, security teams can no longer afford to treat identity as a routine item on a checklist. It must be recognized as a cornerstone of modern defense. Yesterday’s tools and approaches won’t hold up against the evolving tactics of today’s attackers. To stay ahead, security leaders need to reexamine their approach to identity, reinforce the weak spots, and shift from simply reacting to actively preventing before the next incident unfolds.
**UPDATED: May 8, 2025 16:15 ET** Remember the last time you felt bulletproof because your EDR was running? That sense of security can vanish in a heartbeat, especially when attackers use your own ...
Read MoreBig news just dropped that's making waves across the cybersecurity space: SSL/TLS certificates are on track to have a maximum lifespan of **just 47 days** by 2029. That’s right, less than two months. ...
Read More
