What Is Account Takeover? The FBI's 2025 Figures (About 4,700 Complaints, $359.7 Million), How Stolen Passwords and Stolen Sessions Get Used, and What Stops Each
If you want to make account takeover harder this week, move your most valuable accounts to phishing-resistant sign-in and tell people that a web page should never ask them to paste a code or token. Account takeover, or ATO, is when an attacker gets control of a legitimate account and uses it as the owner. The FBI's 2025 Internet Crime Report lists it at about 4,700 complaints and $359.7 million in losses, and says the FBI's fund-freezing team saw a rise in these cases in 2025. This page explains what compromised credentials mean, how the takeover happens, and what stops each route.
What does "compromised credentials" mean?
It means someone other than the owner can authenticate as them. That can be a password, a one-time code, an API key, a session cookie or an access token. The effect is the same in each case: the attacker does not break in, they sign in. Whatever the account can do, the attacker can do, and the logs show a legitimate user.
How big is it?
From the FBI's 2025 Internet Crime Report, the figures are about 4,700 account takeover complaints and $359.7 million in reported losses. They are complaints people chose to file, so they are a floor. The report adds that the FBI's Recovery Asset Team, which asks banks to freeze fraudulent recipient accounts, saw a rise in tech support and account takeover cases in 2025, and that an ATO incident can involve 50 or more transactions to different accounts at multiple banks at the same moment, over ACH.
How does the takeover happen?
These are cases we covered in the last few weeks, from other researchers' work.
- A fake sign-in that captures the code too. Wiz reported on October 20 that attackers bought search ads on the words a cloud administrator types, such as "google cloud," and sent clicks through a redirect to a fake Google sign-in. The page captured the password and the MFA code, logged in at once, then passed the person on to the real login so nothing looked wrong.
- A fake event page that asks for a code. Push Security reported on November 5 that fake OpenAI, SpaceX and Anthropic event pages take Microsoft work sessions. A page fetches a device code, shows it in a "Confirm access" box and opens Microsoft's real login. The person pastes the code and approves, and Microsoft issues tokens to the attacker's session. For Google accounts, a proxy relays the real sign-in and captures the password, the MFA response and the session cookie.
- A page that asks you to paste a raw token. Google's report on LLMjacking describes pages posing as application portals that ask the victim to paste a JSON payload containing an active access token, which skips the password and the MFA prompt.
- A key that was leaked and never revoked. LiteLLM's root-cause analysis says an administrative key committed to a public repository on May 27 was never revoked and was used on October 10. Truffle Security reported on November 4 that 81 percent of leaked keys it disclosed in a 2025 study were still valid six months later.
None of these needs a software vulnerability. They need a person to type, paste or approve something, or a secret to sit somewhere it should not.
What stops each route?
These are our suggestions, matched to the routes above.
- Password plus one-time code phished at a fake page. Phishing-resistant sign-in, such as a hardware security key or a passkey, which will not work on a look-alike site. A code that a person can type into a fake page can be relayed.
- Device-code sign-in. If you do not need it, consider blocking it with a conditional access policy in Microsoft's tenant controls. If a user may have approved one, revoke their sessions and refresh tokens, and reset the password, because a stolen session outlives a password change unless it is revoked.
- Pasted tokens. Teach one rule: no web page ever needs you to paste an access token or a code into a sign-in you did not start.
- Leaked keys. Scan for secrets, rotate first and delete second, and prefer keys that expire. We published a free scanner for secrets in Claude Code settings files, claude-settings-leak-check, which you can run with npx claude-settings-leak-check --root ~/code.
- Money already moving. The FBI's guidance is to contact your financial institution immediately, request a recall of the funds, and file a complaint at ic3.gov regardless of the amount, with full transaction details.
How do you tell it has happened?
Look for sign-ins from devices and places you do not recognize, new device-code authentications, new forwarding or inbox rules, new keys, tokens or billing administrators, and payment instructions that changed. The attacker is using a real identity, so the signal is behavior that does not fit the person.
Indicators
None. This is an explainer on an attack type, so we added nothing to the feed. The indicator lists for the individual campaigns are in the posts that covered them.
Limits
The FBI figures are from its 2025 report and cover only complaints filed. We read the figures, the fund-freezing passage and the title of its account takeover advisory, and we did not read that advisory. The cases are other researchers' findings as covered in our earlier posts. The defenses are our suggestions, and none guarantees safety, since a determined attacker can also steal a session from a compromised device.
Five percent of this is wrong somewhere. It always is. The FBI's next report will change every number here.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.