Stolen Credentials And Valid Account Abuse Remain Integral To Financially Motivated Intrusions
Fortinet, Thursday, October 30th, 2025
Mid-Year IR Report: Stolen Credentials and Valid Account Abuse Remain Integral to Financially Motivated Intrusions
Throughout the first half of 2025, the FortiGuard Incident Response team responded to dozens of engagements across multiple industries that we attribute broadly to financially motivated threats. Each case we investigated had unique circumstances, but several consistent themes stand out: attackers are continuing to rely on valid accounts and legitimate remote access tools instead of 'implant-heavy' intrusions.