The (Near) Return of the King: Account Takeover Using the BadSuccessor Technique

Published

2025-10-20 16:00

Collected

2026-10-17 05:06

---
id: 9485
title: "The (Near) Return of the King: Account Takeover Using the BadSuccessor Technique"
source_domain: specterops.io
source_url: "https://specterops.io/blog/2025/10/20/the-near-return-of-the-king-account-takeover-using-the-badsuccessor-technique/"
published_at: "2025-10-20T16:00:00Z"
phying_url: "https://phying.com/item/9485"
lang: en
---

# The (Near) Return of the King: Account Takeover Using the BadSuccessor Technique

## Summary

After Microsoft patched Yuval Gordon’s BadSuccessor privilege escalation technique, BadSuccessor returned with another blog from Yuval, briefly mentioning to the community that attackers can still abuse dMSAs to take over any object where we have a write primitive. This blog will showcase exactly that, plus announce the release of the BadTakeover BOF.

## Intelligence Metadata

- **Sources:** specterops.io
- **Published:** 2025-10-20T16:00:00Z
- **Original:** https://specterops.io/blog/2025/10/20/the-near-return-of-the-king-account-takeover-using-the-badsuccessor-technique/
- **Phying News:** https://phying.com/item/9485