Threat intelligence / Technique

Valid Accounts

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access. Credentials may take the form of usernames and passwords of individual user accounts or API keys that provide access to various AI resources and services. Compromised credentials may provide access to additional AI artifacts and allow the adversary to perform [Discover AI Artifacts](/techniques/AML.T0007). Compromised credentials may also grant an adversary increased privileges such as write access to AI artifacts used during development or production.

Technique

TypeTechnique

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access. Credentials may take the form of usernames and passwords of individual user accounts or API keys that provide access to various AI resources and services. Compromised credentials may provide access to additional AI artifacts and allow the adversary to perform [Discover AI Artifacts](/techniques/AML.T0007). Compromised credentials may also grant an adversary increased privileges such as write access to AI artifacts used during development or production.

11 recorded

Relationships

mitigates

from Control Access to AI Models and Data at Rest

Mitigation

mitigates

from Control Access to AI Models and Data in Production

Mitigation

uses

from AIKatz: Attacking LLM Desktop Applications

Campaign

uses

from Arbitrary Code Execution with Google Colab

Campaign

uses

from Data Exfiltration from Slack AI via Indirect Prompt Injection

Campaign

uses

from Face Identification System Evasion via Physical Countermeasures

Campaign

uses

from LAMEHUG: Malware Leveraging Dynamic AI-Generated Commands

Campaign

uses

from LLM Jacking

Campaign

uses

from Microsoft Azure Service Disruption

Campaign

uses

from OpenClaw 1-Click Remote Code Execution

Campaign

uses

from Storm-2139 Azure OpenAI Guardrail Bypass

Campaign

2 external

References

mitre-atlas

AML.T0012

mitre-attack

T1078