What is credential harvesting?¶
Credential harvesting is the collection of usernames, passwords, authentication codes or other information used to gain access to accounts.
Avoid the dangerous assumption¶
The dangerous assumption is that credential harvesting always requires the victim to type a password into a fake website.
Credentials may be obtained through:
- phishing pages
- malware
- keylogging
- browser data theft
- compromised password managers
- social engineering
- database breaches
- network interception
- malicious applications
- reuse of credentials stolen elsewhere.
The term describes collection, not necessarily later use.
Investigators should identify what type of credential may have been captured and what system it related to. A username and password may be insufficient where additional controls apply. A session token or authentication cookie may allow access without another ordinary login.
Relevant evidence may exist in:
- phishing infrastructure
- web-server logs
- device and browser artefacts
- malware detections
- identity-provider records
- password-reset events
- multi-factor prompts
- account session history
- later unauthorised activity.
Do not assume that credentials were captured merely because the victim reached a phishing page. Establish whether information was entered, transmitted or stored where possible.
Likewise, later account compromise does not automatically prove which collection method was used. The same credentials may have been leaked previously, reused across services or obtained from another source.
The account holder may also have shared credentials legitimately or insecurely, which may affect interpretation.
Credential harvesting may support preparation for account takeover, fraud, access to data or movement into other systems.
Operational takeaway¶
Identify what authentication material may have been collected, preserve evidence of the collection route and avoid assuming that later account access proves a particular harvesting method.