Social Engineering & FraudMANIPULATIVE

Credential Harvesting

What it is

The collection of usernames, passwords, and authentication codes at scale, typically through counterfeit login pages, so that stolen credentials can be used or resold for account takeover.

How it works

Credential harvesting separates the theft of a password from its use, industrializing both. A counterfeit login page (reached via phishing, a lookalike domain, or a malicious ad) captures whatever the victim types, including the one-time code from an SMS or authenticator app if the fake page relays it to the real site in real time. Harvested credentials are validated automatically and either used directly or sold in bulk, which is why a single convincing page can compromise thousands of accounts. Password reuse multiplies the damage: one stolen pair is tried against many services in "credential stuffing." Thomas and colleagues measured this economy, identifying over a billion breach-exposed credentials and millions of phishing-kit victims in a single year, and found phished credentials the most dangerous because they come with the context needed to defeat security questions. Doerfler and colleagues showed the defense that works: phishing-resistant factors such as security keys blocked essentially all the targeted takeovers that SMS codes let through.

Real-world examples

•A "your mailbox is full, log in to keep your account" email leads to a pixel-perfect copy of a webmail sign-in page that records the password entered.
•Adversary-in-the-middle kits proxy the real login in real time, capturing the session even when the victim completes an SMS or app-based code.
•Credential-stuffing attacks replay username-password pairs from old breaches against banking and retail sites, succeeding wherever people reused a password.
•The 2022 "0ktapus" campaign harvested employee logins and one-time codes from more than a hundred companies through texted links to fake Okta pages.

Ethical guidelines

●Collecting others' credentials by deception is theft and unauthorized access; there is no legitimate version outside a scoped, authorized security test.
●Even in authorized phishing simulations, captured credentials must be handled so that no real secret is stored or exposed.
●Services should adopt phishing-resistant authentication rather than leaving customers to shoulder the risk of reused or phished passwords.

How to defend against it

►Use a password manager and let it autofill; it releases a saved password only on the exact domain it belongs to, so a counterfeit page receives nothing.
►Turn on phishing-resistant MFA (passkeys or hardware security keys) for email, finance, and identity accounts; unlike texted codes, a key will not authenticate to a fake domain.
►Never reuse passwords; a manager makes every login unique so one breach cannot unlock the rest.
►Reach login pages by typing the address or using your saved bookmark, never by following a link in a message that created urgency.
►If you may have entered a password on a fake page, change it and any reused copies immediately from a known-good device, and review account activity and recovery settings.

From the Defense Playbook

Out-of-Band Verificationminutes

Confirm any request that arrives through one channel (email, text, chat, a phone call) by reaching the supposed sender through a different channel you already trusted before the request existed.

Never Pay (or Move Money) to Protect Moneyseconds

No bank, agency, or company will ever ask you to move, withdraw, convert, or hand over your money to keep it safe, so any such request identifies the person making it as the threat.

Multi-Factor Authentication and Passkeysminutes

Turn on a second factor for every account that matters and prefer phishing-resistant forms (passkeys or hardware security keys), so that a password typed into a fake page or talked out of you on the phone is not enough to take the account.

Every playbook entry states how strong its evidence is and when not to use it. Browse the full playbook.

References

Thomas, K., Li, F., Zand, A., Barrett, J., Ranieri, J., Invernizzi, L., Markov, Y., Comanescu, O., Eranti, V., Moscicki, A., Margolis, D., Paxson, V., & Bursztein, E. (2017). Data Breaches, Phishing, or Malware? Understanding the Risks of Stolen Credentials. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security (CCS 2017) · link
Measurement of the stolen-credential economy and the finding that phished credentials pose the greatest hijacking risk.
Doerfler, P., Thomas, K., Marincenko, M., Ranieri, J., Jiang, Y., Moscicki, A., & McCoy, D. (2019). Evaluating Login Challenges as a Defense Against Account Takeover. Proceedings of the 2019 World Wide Web Conference (WWW 2019) · link
Security keys blocked all targeted takeovers in the study, versus 76 percent for SMS codes.
Dhamija, R., Tygar, J. D., & Hearst, M. (2006). Why Phishing Works. Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (CHI 2006), 581-590 · link
Evidence that users cannot reliably distinguish counterfeit login pages from genuine ones.

Last reviewed 2026-09-07

Suggest a correction

Detect Credential Harvesting in any text

Paste any message, email, or article into our free Manipulation Detector to see if Credential Harvesting or other techniques are being used on you.

Try the Detector Free Create Free Account

Social Engineering: Why Smart People Fall for It

Social engineering does not target stupidity. It targets helpfulness, deference, and time pressure, which are the same habits that make people good at their jobs. Here is how the attacks are built and which procedures actually stop them.

7 min read

The Disinformation Playbook: How Campaigns Are Built and Where They Break

Disinformation campaigns follow a recognizable sequence: seed, launder, amplify, and let real people carry it the rest of the way. A field guide to the stages, drawn from the research, with the defences that work at each one.

8 min read