Ghostdrive

News · Academy · November 12, 2026

Academy: logins, admins and the stolen-credential problem

Stolen access is a top entry point and 46% of human logins used leaked credentials. Rules for admin accounts, MFA and sessions in a company.

DRIVE 369 DAO · 2 min read

Academy, organisations, lesson 8. The easiest way in is often a login that already works. This lesson is about making stolen credentials less useful.

The facts

  • Cloudflare's 2026 threat report finds that 94% of login attempts were bots and 46% of human logins used previously breached credentials (reported by Help Net Security).
  • Mandiant lists voice phishing (11%) and previously stolen access (10%, and 30% in ransomware cases) among the top ways in (M-Trends 2026). Verizon's 2026 report now ranks exploited vulnerabilities (31% of breaches) ahead of stolen passwords as the top way in (Verizon).
  • In October the ConnectWise Cloud Backup incident showed a worse case: a stolen application credential produced sign-in activity across almost 1,000 Microsoft 365 tenants, more than 300 of them successful, and because the sign-ins were application-only, user multi-factor authentication did not apply (briefing).

Rules that work

  1. Phishing-resistant sign-in for everyone, and first for administrators. Passkeys and hardware keys are bound to the real website, so a fake page cannot collect them. Text-message codes and approval pushes can be talked out of people.
  2. Separate admin accounts. An administrator uses a day-to-day account for mail and a separate one for admin work, with no mailbox.
  3. Keep a short list of privileged accounts and review it monthly. The NCSC asks you to include vendor and service accounts and to baseline each one's normal behaviour.
  4. Treat service and application credentials like users. Give them the narrowest scope, a short life where possible, and alerts when used from a new place. Multi-factor does not protect them.
  5. Block reuse. Check new passwords against breached lists and never allow one password on two systems.
  6. Remove access when people leave, the same day, including API keys and shared accounts.
  7. Watch the grants. List the third-party apps connected to your Microsoft 365 or Google tenant and the permissions each holds. Remove those nobody can explain.
  8. Plan for stolen sessions. A token that has already passed multi-factor can be replayed. Short session lifetimes and device checks limit it.
  9. Train for the phone call. A fake helpdesk voice is part of the social engineering lesson.

How Ghostdrive approaches it

There is no password to steal: your Ghost ID is a key on your device, opened by a passkey or by 24 recovery words, with no company that can reset it for a stranger. If you lose both, nobody can recover your vault, so protect the words. The access journal tells you when another device opens it. Pass keeps logins and live two-factor codes for the accounts you still have elsewhere.

Academy: start here · Social engineering · Secrets and rotation