Cloud account compromise is the unauthorized use of a valid cloud identity, such as a user, admin, or service account, to access systems, data, or management functions. Unlike malware that breaks in loudly, this attack uses legitimate credentials, session tokens, or trusted approval paths, so the activity can look like normal sign-in behavior at first.
It matters because cloud platforms centralize email, files, databases, and security controls. If an attacker hijacks one account, they may read sensitive data, change settings, create new access, or move laterally into other services. Common paths include phishing, social engineering, password resets, token theft, and abuse of weak multi-factor authentication. Defenses focus on strong MFA, conditional access, least privilege, alerting on unusual sign-ins and data access, and rapid revocation of suspicious sessions and tokens.