The dark web in the age of AI – Dark web marketplaces offer stolen credentials from data breaches for sale or even free download. Sometimes these credentials have been compiled and deduplicated from many breaches to make one large database of username and password pairs. Criminals purchase or download these lists and use bots to test these credential pairs across thousands of websites – matches may grant them access to live accounts.

Even though these practices predate large-scale AI use, pattern-finding AI is especially effective in amping up the volume and accuracy of these kinds of damaging activities.

Email accounts are the main targets for account takeover attacks. Controlling someone’s email can enable password resets on other accounts. Because attackers are using real credentials, these incursions are not easy to detect once they’ve begun. In fact, to find a worthwhile theft opportunity, it’s common for criminals to squat and read emails looking for ways they might get access to funds or to escalate their attack to other accounts.¹

This means one of the best defenses, explored more fully in this Up Times, is to prevent these account-takeover attacks before they happen. Dark web monitoring searches for your organization’s email addresses in underground criminal internet activity. If one of your employees’ email addresses shows up in a database, you and/or your assigned admin are alerted so that steps can be taken to change what’s affected by the leaked credentials – for the purposes of trying to block criminal abuse.

It’s not easy to think about dealing with a thing before it happens. But awareness of criminal activity concerning your accounts, before the actual attack, is one of the most effective front-line defenses. Consult your Bryley rep about the best way to implement this for your organization.

^{1 https://www.huntress.com/blog/account-takeover-what-it-is-and-how-to-protect-against-it}