Account Manipulation (T1098)

Account manipulation is an unauthorized change an attacker makes to an existing account, its credentials or its permissions, such as adding a key, a sign-in device or administrator rights, to keep or expand access. Some of these changes can remain after a password reset, so resetting the password may not be enough.

Explain It Like I'm 10

Someone logs into your account on the class group chat with your password. Before leaving, they quietly make their own account an admin of your group. The next day you change your password. Their own account is still an admin, so they can still delete messages and add people. To get them out, someone has to take them off the admin list.

How account manipulation works

Account manipulation is not a way in. The attacker needs sufficient permissions for the particular change, which can come from controlling the account itself or from wider rights over the system or domain it lives on. With enough rights they can change another account without knowing its password, for example by resetting an administrator's. A stolen ordinary password does not automatically allow administrator-role assignment or unrestricted changes to other accounts: MITRE advises that low-privileged accounts should not have permissions to modify accounts or account-related policies.

The service treats the change as an ordinary setting of the account, and what it does for the attacker depends on its kind: an added credential can be another way to sign in, an added sign-in device can answer a second check, and an added role or group changes what the account is allowed to do. A change made to the account can remain after the password the attacker started with is replaced.

How security teams classify it

Persistence is keeping access "across restarts, changed credentials, and other interruptions that could cut off their access"; privilege escalation is gaining higher-level permissions. MITRE ATT&CK, a public knowledge base of attacker behaviour built from real-world observations, files account manipulation as technique T1098 under both, with seven sub-techniques for the different places a change can be made.

What attackers change

The changes MITRE describes fall into a few kinds:

• Extra credentials: a key or a password added to a cloud account or to an application, alongside the legitimate ones. One kind, the app password, exists for older devices that do not support multi-factor authentication (MFA), which asks for factors from at least two categories, such as something you know and something you have, so adding one can let an attacker bypass MFA.
• A new sign-in device: someone who has the account's username and password registers their own device for MFA, so the second check now reaches them too. In some cases first-time setup asks for nothing more than the username and password, which leaves accounts with no device yet, including inactive ones, open to this.
• More permissions: a new role, such as an extra global administrator in an Office 365 environment, or membership of a powerful group, such as a VPN users group or an administrators group.
• Mailbox access: extra permission levels on an email account, so the attacker keeps access to it.
• SSH keys: on servers managed remotely over SSH with key-based sign-in, an extra key added to the file that lists which keys may log in to an account.

MITRE also counts quieter changes, such as changing a password again and again to get around rules that force it to expire, which keeps a stolen password usable.

Why a password reset may not be enough

A password reset replaces one credential: the password. It is still needed, but what the attacker keeps afterwards depends on what they added, because the three kinds of addition work differently:

• An added credential: a key such as an SSH key is a separate way to sign in. Whether other credentials survive a reset depends on the service: in Microsoft Entra ID environments with the app password feature enabled, an app password may remain valid even if the primary password is reset.
• An added second factor: in a sign-in that needs a password plus a second factor, an attacker's registered device supplies only the second one. A password is something you know and a device is something you have, so the device does not replace the password; it gives the attacker the second factor, which is why recovery removes it. This describes the password-plus-MFA flow only.
• An added role or group: it changes what the account is allowed to do, not who is signing in. It can remain after a reset, but it does not authenticate anyone: the attacker still needs to sign in to that account, or to another identity that was given the permissions.

A campaign Microsoft disclosed in January 2026 shows what this means for recovery. Attackers took over mailboxes through AiTM phishing, and Microsoft noted that an attacker in that position could add their own one-time-password method for MFA. Its advice to the affected organizations was blunt: "Password resets alone are insufficient." The sign-in session was already compromised, so its recovery advice included revoking active session cookies and the MFA changes the attacker had made. Getting an attacker out means resetting the compromised credentials, revoking sessions, and finding and removing each unauthorized change.

How one change can raise an attacker's access

Account manipulation is also how an attacker climbs. Adding a role or a group to an account they hold can give it powers it never had, and MITRE notes that this can lead to privilege escalation when the new role reaches other accounts.

In a 2025 investigation, Mandiant documented an attack playbook used by Scattered Spider, a group it tracks as UNC3944. In the playbook, attackers call IT help desks while impersonating employees, first to get an ordinary employee's password reset and then a privileged administrator's. In the environments Mandiant describes, a clearly named directory group such as "ESX Admins" grants administrative rights over the virtual environment, so adding an account they controlled to it gave that account "full admin rights to vSphere", the platform that runs the organization's virtual servers. In those environments, one change to one group's membership handed over the virtual environment.

Account manipulation vs similar terms

• Using a stolen account: signing in with credentials the attacker already has, exactly as the owner would. Account manipulation goes further and changes the account so the access lasts or grows.
• Creating an account: making a new account to keep access. Account manipulation changes an account that already exists.
• MFA fatigue: floods a person with approval prompts until one is approved, to get in. Registering the attacker's own device once inside is account manipulation.
• AiTM phishing: relays a real sign-in through a fake page and takes the session it produces. Adding an MFA method afterwards, as in the 2026 campaign above, is account manipulation.
• Consent phishing: the person, not the attacker, approves a malicious app's request for access, and password theft is not required.

How defenders catch and prevent it

Each of these changes is an action the service can record in its audit log, a record providing documentary evidence of specific events. That makes them catchable. MITRE's detection guidance asks defenders to name the high-privilege groups they want watched and to flag a change made to an account by a different account, which can mean that account was hijacked. Mandiant's advice after the vSphere attacks was to treat powerful groups as the most sensitive assets: tightly control who can change their membership, and raise an alert on any change.

Prevention works on the same changes. MITRE recommends requiring MFA before a new device can be registered and refusing device registration for inactive accounts, which closes the self-setup route. Keeping domain administrator accounts out of everyday work limits what a stolen everyday account can change, and removing authentication methods nobody needs leaves fewer things for an attacker to add to.

What to check if one of your accounts was taken over

Resetting the password matters, but it may not remove what the attacker added, so recovery covers four things:

• Change the password, then sign out everywhere: log every other device and app out of the account, usually from its settings, as the UK National Cyber Security Centre's recovery steps describe.
• Look for what was added: go through the account's security settings for sign-in devices, MFA methods and app passwords you did not set up, and remove them.
• Check the mailbox: look for forwarding rules and filters you did not create, which the NCSC calls a common criminal tactic, and for anyone else given access to it.
• At work, tell your IT or security team: they can check the account's roles, groups and added credentials, and undo changes you cannot see yourself.