Identity attacks

Intrusion activity aimed at accounts and authentication systems rather than at software flaws, including credential stuffing, MFA bypass, token theft, and post-compromise persistence through mail rules and OAuth grants.