Glossary
Account Takeover
Account takeover is the outcome, not the technique: an attacker ends up in control of an account that legitimately belongs to someone else, most often by obtaining valid credentials through credential stuffing, phishing, or a leaked password, rather than by exploiting a flaw in the system itself. From the system's point of view, the resulting requests look exactly like the legitimate user, because the credentials genuinely are valid.
This is precisely why credential validity alone is a weak signal on its own — a takeover succeeds by presenting exactly what the system asks for. Detecting it usually depends on secondary signals: a login from an unfamiliar device or location, a sudden change in behavior, a request pattern inconsistent with how the account is normally used.