Credential abuse remains a major route into the business, but it increasingly exploits trusted platforms and identities outside the organisation’s immediate control.
Since March 2026, Mimecast has observed more than 50,000 malicious campaigns abusing Microsoft’s legitimate OAuth device-authorisation process to steal authentication tokens and compromise Microsoft 365 accounts across regions and industries.
In a separate January campaign targeting nearly 5,000 companies, including companies in South Africa, attackers used compromised SendGrid accounts and other trusted infrastructure to distribute credential-harvesting messages.
Credential attacks are increasingly starting outside of the organisation as criminals compromise trusted email, CRM or cloud service accounts and use them to send convincing phishing messages, steal login details or obtain valid authentication tokens.
The problem is that a large number of these credentials are still live, and usernames and passwords belonging to a company’s customers and users regularly surface in criminal marketplaces on the dark web. Usually, the company in question doesn’t even know they have a problem, so when these credentials are tested, many still work.
The accounts are active, the passwords haven’t been changed, and the login page has no way of distinguishing the legitimate customer from anyone else holding the same details. For the business, the first sign of trouble is a complaint from a customer rather than an alert from a security tool.
Password reuse is what gives these leaks such reach. Customers are using the same email address and password combinations across multiple platforms and sites – shopping, streaming, forums, loyalty programmes – so a breach at one provider becomes a key to open multiple accounts.
Attackers don’t need to guess, they simply need to try the combinations they have already bought against as many login pages as they can reach. The company with a login that accepts that password may not have ever been breached, but it is inheriting the consequences of a compromise that happened somewhere else, and it is usually the last to find out.
This by and around attack methodology puts customer accounts in an uncomfortable position within your security strategy. You have invested heavily in protecting your systems, but your customer’s login sits largely outside your efforts.
You get to decide how your login page behaves, but you have no control over the password a customer chooses or how many other places that password has been used. Customer accounts also cross departmental lines – ecommerce, marketing and customer service own the account while security owns the risk, so responsibility falls between them.
Reducing that exposure starts at the point of entry – login. Many customer-facing platforms still grant access with a username and password only, with no code sent to a mobile device or no prompt to approve a new sign-in. When you add multi-factor authentication to your customer accounts, you are removing a large percentage of the value of a leaked password.
This is invaluable when it comes to protecting your data and systems because one moment of MFA means you are preventing criminal access to invoices, delivery addresses or saved payment details.
You should also monitor your sign-ins against known leaked credentials, flag logins from unfamiliar devices, ask dormant accounts to re-verify their identities, and limit the amount of personal information shown on downloadable documents.
Clear communication offsets the inconvenience to your customers as well because if they know exactly how you will communicate with them and why you are implementing these measures, they will be more aware of risk and process.
There isn’t much you can do about customers reusing their passwords. People will always choose the easiest route, especially when they are busy and tired and remembering dozens of unique password combinations is a burden most of them will avoid.
What you can change is how you recognise proof of identity – is it just a correct password or are you going to put additional measures in place that make it tough for compromised credentials to gain access? The customer chooses the password, but you get to decide what doors that password can open.
Share