How can credentials be stolen?¶
Credentials can be stolen through several different routes, and the route matters because it determines what evidence may exist.
Avoid the dangerous assumption¶
The dangerous assumption is that a later unauthorised login proves the password was captured through phishing.
It does not.
Possible routes include:
- fake login pages
- malware or information stealers
- keylogging
- browser data theft
- compromised password managers
- database breaches
- credential reuse
- social engineering
- shoulder surfing
- insecure notes or files
- interception of recovery messages
- remote access to a trusted device
- theft of session cookies or tokens.
Each route creates different evidence.
Phishing may leave messages, domains, page captures and browser traces.
Malware may leave execution, file, process and network artefacts.
A database breach may produce leaked credential sets.
Browser theft may expose stored passwords, cookies and session material.
Social engineering may create call, message and provider records.
Investigators should avoid choosing one route too early.
Ask when the account was last known to be under legitimate control, when suspicious activity began and what authentication material would have been sufficient.
Also check whether the victim reused credentials across services. A password stolen from one service may later be used against another.
The presence of several possible routes should be reported honestly. It may be possible to prove account compromise without proving exactly how the credentials were obtained.
Do not confuse the acquisition route with the later access route. Credentials may be stolen through one method and used through another system, location or device.
Operational takeaway¶
Identify all plausible credential-theft routes, preserve the evidence specific to each and avoid attributing later access to one method without support.