Account takeover (ATO) cyberattacks are a particularly pernicious and challenging threat to combat. They have only grown more complex as credential management becomes increasingly intricate across organizations. According to a recent Barracuda 2025 Email Threats Report, 20% of companies experience at least one ATO incident each month.
Once criminals can control an email, social media, cloud, or retail account, they can quickly move through organizations, steal data or launch phishing attacks using legitimate email addresses. These attacks can not only lead to lost data or money, but also deeply damage the reputation of account holders.
Criminals can gain unauthorized access to an account in several ways. Hackers might use credential stuffing or card cracking attacks, bot-fueled brute-force attacks, buy credentials on the dark web, or obtain passwords through data breaches. Phishing campaigns can also harvest passwords and credentials via social engineering, fake websites and malicious links.
Attackers also exploit a common problem: weak passwords. Users often reuse passwords, use older or simpler passwords or employ easy-to-guess combinations.
These attacks are also difficult to detect for several reasons. First, bank accounts are a big target of these attacks, and banks may not closely monitor account activity or send alerts. New technology is also helping. Botnets and proxies can be configured to mimic actual user behavior, and many bots can defeat CAPTCHA challenges. Over the past decade, a significant increase in e-commerce activity has made it easier for attackers to mask their attacks during high usage.
Protecting your clients from ATOs
MSPs can help customers protect their accounts, networks and reputations from these attacks. Still, it requires a holistic approach that combines training, best practices and advanced monitoring technology. Those include:
Employee training and education: MSPs can help clients conduct regular cybersecurity awareness training on best practices, how to recognize unusual activity within their email accounts, such as unexpected multifactor authentication (MFA) requests, and emerging threats. Regular threat updates can help keep employees informed about new threats, and phishing simulations can assess the effectiveness of training and identify specific employees who may require additional support.
Smart password requirements. MSPs should help clients establish rules for creating strong passwords and implement MFA and Zero Trust access for added protection.
Attack detection strategies: Businesses can limit the number of login attempts by locking accounts and using technology to track login attempts and locations. Web application firewalls can be used to detect brute force and other types of attacks, and systems can be configured to block specific IP addresses associated with attacks.
ATO protection solutions that use behavior and contextual signals to detect attacks are also available and can monitor several common ATO symptoms, including:
- Sign-in anomalies: Sudden logins from geographically distant locations often indicate a compromise or attack, and these logins can be flagged and investigated. These “impossible travel” events can take VPN and proxy usage into account to reduce false positives and focus efforts on potential attacks. Administrators can receive real-time alerts to accelerate response times.
- Inbox rule monitoring: Attackers often create mailbox rules to auto-forward or delete messages. The ATO solution can detect and monitor suspicious changes to mailbox rules.
- Inbound and outbound email monitoring: An ATO solution can detect spikes in outbound emails that could indicate an account is being used for phishing attacks. With real-time alerts, staff can quickly investigate a potential breach based on how the attacker uses the account after logging in.
- In the case of the Barracuda ATO protection, the solution can be integrated with XDR to detect threats across all Microsoft 365 modules, thereby preventing attackers from accessing an account. The solution can also be integrated with other platforms, such as Google Workspace, AWS, Azure, and more, and automatically sign out of or deactivate compromised accounts as soon as an attack is detected.
Adopt a platform approach: When strengthening your defenses against ATO attacks, using a platform strategy simplifies operations and improves response times. Here are three key best practices for MSPs to consider:
- Choose solutions that offer immediate visibility into all customers and tenants. Unified visibility helps you quickly spot anomalies across your client base, making it easier to detect and respond to suspicious activity before it escalates.
- Consolidate alerts from all accounts into a single actionable view. This is particularly useful for MSPs managing multiple tenants, as it centralizes incident response, minimizes alert fatigue, and promotes efficient threat investigation and management.
- Automatically notify users of any account changes. Sending timely alerts—such as warnings about password updates or suspicious login attempts—empowers users to respond quickly to potential threats and minimize the damage from compromised credentials.
Empower your clients, protect their future
ATO attacks pose a relentless and evolving threat to businesses of all sizes. As an MSP, you’re on the front lines, uniquely positioned to shield your clients from financial losses, reputational damage and operational disruption. By implementing a holistic defense strategy that integrates robust employee training, smart password policies and advanced monitoring solutions, you can significantly reduce the risk and impact of ATO breaches.
Don’t wait for your clients to become another statistic. Take proactive steps to empower them with the knowledge and technology they need to stay secure. Your expertise in combating ATOs won’t just protect their accounts; it will fortify their trust in your services and cement your role as their indispensable cybersecurity partner.
