Credential Harvesting

Credential harvesting is the systematic collection of login credentials — usernames, passwords, and increasingly session tokens — from victims at scale. It is the supply side of the stolen-identity economy: the harvested credentials are what later power credential stuffing campaigns, account takeover and business email compromise. Where a targeted attack wants one specific person's password, a harvesting operation wants everyone's.

How it works

The classic harvesting mechanism is a fake login page. A phishing email, QR code or sponsored search result leads the victim to a pixel-perfect replica of a Microsoft 365, Google or bank sign-in form, and everything typed into it goes to the attacker. Modern phishing kits automate the whole chain — hosting, evasion, real-time credential forwarding — and adversary-in-the-middle kits go a step further by proxying the real login site, which lets them capture the session cookie after multi-factor authentication has already been completed. The second major channel is infostealer malware, which silently extracts every saved password, cookie and autofill entry from an infected browser and uploads them to a marketplace. Harvested credentials are aggregated into combo lists and sold in bulk, which is why a password stolen once can keep resurfacing in attacks for years.

How to defend against it

Because harvesting targets the login moment, the strongest defenses change what a stolen credential is worth. Phishing-resistant authentication — passkeys and FIDO2 security keys — binds login to the real domain, so a replica page captures nothing usable. Breached-password screening and a ban on password reuse limit the blast radius of leaks that have already happened. On the human side, train employees to treat every login prompt that arrives via a link or code as suspect, and to navigate to sign-in pages themselves; measure that behavior with phishing simulations that use realistic credential-capture lures. And rehearse the response: when harvesting is suspected, sessions must be revoked before passwords are rotated, in the order our incident response guide for social engineering describes — otherwise the attacker's captured session outlives the password change.