AI agents and the new economics of account takeover

This article examines a real-world account takeover incident involving the author's mother-in-law, where a single compromised email led to coordinated attacks across a dozen accounts within 24 hours. It details how attackers used credential stuffing, changed security questions, and exploited reused passwords to steal miles, place orders, and post spam. The piece argues that while the attack method is not new, the economics have shifted due to AI agents enabling faster, more automated exploitation. It highlights the gap between security-conscious users and average people, and emphasizes the growing threat of automated, multi-vector attacks. The article is highly relevant to IT/technology, focusing on cybersecurity, credential stuffing, and the impact of AI on attack economics.