Credential phishing and session theft explain about half of the incidents studied. Abuse of cloud tokens grew 41% in a year.