Technique T1078

Valid Accounts

CLEARED FOR PUBLIC RELEASE · OPEN-SOURCE INTELLIGENCE

Valid Accounts (T1078) — a Initial Access technique, observed in public incident reporting.

MITRE ATT&CKT1078

TacticInitial Access

Incidents on file425

Detection & mitigation

Monitor for unexpected GPO creation/modification, especially those deploying scripts or scheduled tasks. Use endpoint telemetry to detect suspicious PowerShell/WMI execution from GPO-deployed scripts, and enforce least privilege on AD to prevent GPO abuse.

Observed in the wild

2026-09-21

valid accounts
PAYLOAD ransomware abuses Active Directory GPO for encryptionless extortion

2026-09-15

valid accounts
VectraRAT MaaS Offers Windows RAT for $250 per Month

2026-09-14

valid accounts
AWS SSM Agent Vulnerability Allows Bypass of Port-Forwarding Restrictions

2026-09-11

valid accounts
New SloppyRAT Trojan Deployed via ClickFix for Ransomware Lateral Movement

2026-09-09

valid accounts
Workflow Identity Hijacking Bypasses Standard Security Controls

2026-09-09

valid accounts
Info-stealing malware targets AI coding agents to steal tokens and prompt histories

2026-09-08

valid accounts
BigBear 2.0 Phishing Platform Compromises 258 Microsoft 365 Organizations by Disabling FIDO2 Hardware Keys

2026-09-07

valid accounts
Modified ScreenConnect Clients Used in Worm-Like Campaign

2026-09-01

valid accounts
Anthropic Force-Logs Out Users After Infostealer Malware Hijacks Claude AI Sessions

2026-08-31

valid accounts
Spring Ring: Voice Phishing Campaign in Microsoft Teams Deploys Malware

2026-08-26

valid accounts
Iran-Linked Tortoiseshell Uses Reverse SSH Tunnels for Espionage

2026-08-26

valid accounts
Hackers Abuse Legitimate RMM Tools in 46-Country Phishing Campaign

2026-08-21

valid accounts
Peer2Profit Turns Employee Devices Into AstroProxy Nodes That Can Expose Internal Networks

2026-08-13

valid accounts
AmnesiaStealer Hijacks Chromium Sessions to Give Attackers Live Browser Control on macOS

2026-08-11

valid accounts
New Abyssos RAT Combines Credential Theft, Browser Session Hijacking, and Hidden VNC Access

2026-08-10

valid accounts
Sophos Reports Interlock Ransomware Exploits Unprotected Endpoints for Credential Theft

2026-08-09

valid accounts
Hackers compromise Mexican company printer to demand $3,000 ransom

2026-08-05

valid accounts
EtherRAT Malware Spreads via Remote Scheduled Tasks Across Windows Domains

2026-08-04

valid accounts
CaptiveCrunch Campaign Uses ChocoShell Infostealer to Steal Microsoft 365 Tokens

2026-08-03

valid accounts
Pass the Passkey: Attack Exploits Missing User Verification in Passkey Implementations

2026-08-02

valid accounts
Attackers Exploit N-able N-central Authentication Bypass to Access Managed Endpoints

2026-06-25

valid accounts
Malicious Chrome Extensions Steal Session Cookies from Workday, NetSuite, SAP SuccessFactors

2026-05-20

valid accounts
Compromised @antv npm Packages Used for CI/CD Credential Theft

2026-05-20

valid accounts
GitHub Internal Repositories Breached via Weaponized VS Code Extension

2026-05-13

valid accounts
Entra ID Phantom Device Registration and PRT Bypass Enables Full Tenant Compromise

Track this in real time.

ColdRecon watches the public signal so you don't have to — a daily brief and a live detection-coverage desk. Request clearance.

Request Clearance →