New research introduces behavioral fingerprinting to spot attackers just after login — before they hide or cause damage.