Account takeover (ATO) is when an attacker uses vulnerabilities to take control of a victim's account allowing the attacker to preform functions on the victim's behalf. Account takeover can be the result of theft of session tokens, credential stuffing, malware, insecure design of access controls, or social engineering.
References