BSidesSF 2026 - The Great Credential Caper: How to Perform and... (Christo Roberts, Dan Hollinger)

This talk explores the complexities of account takeover (ATO) attacks, highlighting recent breaches such as the $250 million incident involving British Airways. Christo Roberts and Dan Hollinger delve into the tactics used in these attacks, including the utilization of anti-detect browsers and residential proxies for large-scale credential stuffing. Attendees witness live demonstrations of these attacks and gain insights into effective defensive strategies that disrupt the attack patterns.