Compromised legitimate credentials allow adversaries to log into target systems without exploiting technical software vulnerabilities