The account is the target, not the afterthought
Attackers don't want your device — they want you, logged in. An email or social account is a master key: it holds your contacts, it receives password-reset links for every other service, and it lets an attacker impersonate you to your friends, colleagues and bank. This is why account takeover (ATO) is the single most common outcome of real-world attacks.
What the attacker is actually after
- Pivot value — your email is the reset hub; owning it unlocks everything linked to it.
- Trust — messages from your real account bypass suspicion (scams, invoice fraud).
- Data & money — saved cards, crypto, private photos, business secrets.
- Persistence — quiet, long-term access (new forwarding rules, app tokens).
How accounts fall — the short list
Every technique in this course maps to one of these paths:
- Credential stuffing / reuse — a password leaked elsewhere is tried on your account.
- Phishing & session hijacking — a fake login harvests the password, or a stolen session cookie skips it entirely.
- SIM-swapping — hijacking your phone number to intercept SMS codes.
- OAuth / third-party abuse — you "Sign in with…" a malicious app and hand it a token.
- Recovery-flow attacks — the weak recovery email/phone is compromised instead of the account itself.
This course explains each attack so you can defend against it, then shows the exact controls that shut it down.
⚖️ Mobile Security Lab ethos: authorized, legal, defensive only. We study how takeover works to protect accounts — never to access one that isn't yours.
What's in Account Takeover & Protection
- 1. Why Your Account Is the PrizeFree
- 2. Credential Stuffing & Password Reuse🔒 Accounts · Attacks
- 3. Phishing & Session Hijacking🔒 Accounts · Attacks
- 4. SIM-Swapping & Why SMS 2FA Is Weak🔒 Accounts · Attacks
- 5. OAuth & Third-Party App Abuse🔒 Accounts · Attacks
- 6. MFA Done Right: TOTP, SMS & Passkeys🔒 Accounts · Defense
- 7. Password Managers & Unique Passwords🔒 Accounts · Defense
- 8. Account Recovery Hardening🔒 Accounts · Defense
- 9. Monitoring & Response🔒 Accounts · Defense
- 10. Final Exam & Certification🔒 Accounts · Certification
Continue in the interactive course reader →