An attacker phishes a cloud administrator's credentials, signs in, launches dozens of large compute instances for cryptocurrency mining, and creates new access keys for later use. Which cloud threat best describes this incident?

Account hijacking occurs when an attacker obtains valid credentials, through phishing, credential stuffing or leaked keys, and uses them to operate as a legitimate user. In the cloud, a hijacked administrative account grants management plane control, enabling resource abuse such as crypto mining, data theft, configuration changes and persistence through new keys, users or roles. Because actions are authenticated, they can blend into normal activity unless monitored. Insufficient due diligence describes adopting cloud services without understanding the provider, the contract or the responsibilities involved; the scenario's root cause is credential theft, not a flawed selection process. Abuse of cloud services, sometimes called nefarious use, refers to attackers using cloud resources under their own or fraudulent accounts to launch attacks or host malicious content; here the attacker used the victim's account. Shared technology vulnerabilities involve weaknesses in multi-tenant components such as hypervisors that let one tenant affect another; nothing in the scenario involves breaking isolation. Exam caveat: incident response for hijacking must remove persistence, including keys and roles created by the attacker, not merely reset the original password. Operational check: list all access keys and identities created during the compromise window and confirm each is revoked.