What is credential theft?¶
Credential theft is the unauthorised acquisition of information or material used to access an account, system or service.
Avoid the dangerous assumption¶
The dangerous assumption is that credential theft always means somebody discovered the victim’s password.
It may involve:
- a username and password
- a one-time authentication code
- a session cookie
- an access token
- a recovery code
- a password reset link
- an API key
- a private key
- another secret used to authenticate.
Credentials may be stolen through phishing, malware, browser theft, keylogging, compromised devices, database breaches, social engineering, insecure storage or interception.
The evidential question is not simply whether credentials existed outside the victim’s control. It is what was obtained, when it was obtained, how it was obtained and whether it was later used.
Relevant evidence may exist in:
- phishing pages
- malware and browser artefacts
- password-manager records
- identity-provider logs
- password-reset events
- multi-factor prompts
- account sessions
- later authentication attempts
- provider or organisational incident records.
Do not assume the presence of stolen credentials proves successful access. The password may have been old, incorrect or protected by additional controls.
Likewise, successful access does not prove which credential was used. An offender may have replayed a session, used a recovery route, abused an application token or relied on a device that was already trusted.
The account holder may also have reused, shared or disclosed credentials in a way that complicates interpretation.
Credential theft can help explain later account takeover, but it does not automatically identify the thief or the person who used the material.
Operational takeaway¶
Identify exactly what authentication material may have been stolen, preserve evidence of the theft route and separate acquisition from later use.