Credential Harvesting
Identity
Credential harvesting is the practice of collecting usernames, passwords, and other authentication data through deceptive means. Attackers deploy fake login pages, malicious forms, and compromised websites that capture credentials as users enter them. The harvested credentials are then used for account takeover, sold on dark web marketplaces, or leveraged in subsequent attacks against other services where victims have reused passwords.
The most common credential harvesting technique involves creating phishing pages that mimic legitimate login portals for popular services like Microsoft 365, Google Workspace, banking platforms, and corporate VPNs. These pages are distributed via phishing emails, SMS messages, or redirects from compromised websites. More sophisticated operations use man-in-the-middle proxy tools that relay credentials in real time, defeating basic two-factor authentication by capturing session tokens.
Credential harvesting fuels a massive underground economy. Billions of stolen credentials circulate on dark web forums, and automated tools allow attackers to test these credentials across thousands of services simultaneously in credential stuffing attacks. A single harvested credential can cascade into breaches across multiple platforms due to the widespread habit of password reuse.
The most common credential harvesting technique involves creating phishing pages that mimic legitimate login portals for popular services like Microsoft 365, Google Workspace, banking platforms, and corporate VPNs. These pages are distributed via phishing emails, SMS messages, or redirects from compromised websites. More sophisticated operations use man-in-the-middle proxy tools that relay credentials in real time, defeating basic two-factor authentication by capturing session tokens.
Credential harvesting fuels a massive underground economy. Billions of stolen credentials circulate on dark web forums, and automated tools allow attackers to test these credentials across thousands of services simultaneously in credential stuffing attacks. A single harvested credential can cascade into breaches across multiple platforms due to the widespread habit of password reuse.
Key Statistics
- Over 24 billion username-password pairs are currently available on the dark web according to Digital Shadows research.
- Stolen credentials are the initial attack vector in 49% of data breaches per the Verizon 2023 DBIR.
- The average person reuses passwords across 5 or more accounts, amplifying the impact of each harvested credential.
- Credential stuffing attacks account for 34% of all login attempts on major web applications.
Prevention Strategies
- Deploy phishing-resistant MFA such as hardware security keys (FIDO2/WebAuthn) that cannot be intercepted by proxy-based harvesting tools.
- Use a password manager to generate unique, complex passwords for every service, eliminating the risk from password reuse.
- Monitor dark web marketplaces and breach databases for your organization's credentials using threat intelligence services.
- Implement login anomaly detection that flags unusual authentication patterns, locations, or device fingerprints.
- Train users to recognize fake login pages and to always navigate directly to services rather than clicking links in emails.
How Beacky Helps
Beacky detects credential harvesting operations targeting your brand by embedding invisible beacons in your login pages and authenticated areas. When attackers clone these pages to create harvesting sites, the beacons immediately report the unauthorized domain, enabling your team to take down the fake login portal and alert affected users before large-scale credential theft occurs.