Credential harvesting is the systematic collection of usernames, passwords and session tokens so an attacker can log into your systems as a legitimate user — no exploits, no forced entry, just your front door opened with a stolen key. Verizon's 2025 Data Breach Investigations Report puts stolen credentials in roughly one in five breaches and at the top of the basic web application attack pattern at 22% (full report PDF), which makes credential harvesting the most reusable commodity in cybercrime. This guide explains how credentials get harvested, what attackers do with them, and the controls that actually stop it in 2026.
TL;DR
- Credential harvesting is the collection of login details and session tokens for resale or direct account takeover.
- The three main channels are phishing pages, info-stealer malware and reused passwords from third-party breaches.
- Stolen credentials fuel account takeover, business email compromise, payroll fraud and ransomware.
- The core defences: multi-factor authentication, password managers, dark-web monitoring and trained staff.
- An attacker who cannot steal a password tries the person instead — awareness training closes that path.
What credential harvesting means in plain terms
Credential harvesting is any method of collecting authentication data — usernames, passwords, MFA codes, session cookies — so an attacker can authenticate as a real user. It is the quiet enabler behind most of the incidents that make the news: the ransomware that "suddenly" appeared, the mailbox that sent one fraudulent invoice, the payroll that changed bank accounts on the last working day of the month.
What makes it dangerous is not the theft itself but the reuse. A password stolen from a discarded forum account in 2019 can still open a Microsoft 365 mailbox today, because staff reuse passwords across work and personal services. Attackers know this, and they build entire businesses on the assumption.
How credentials get harvested
| Channel | How it works | What it catches |
|---|---|---|
| Phishing pages | A fake login page that mirrors Microsoft 365, Google or your bank; credentials are logged as the user types | Passwords, sometimes MFA codes via real-time proxies |
| Info-stealer malware | Malware that empties saved browser passwords, cookies and session tokens | Everything the browser remembers, including active sessions |
| Third-party breaches | Passwords leaked from other sites are retried on work accounts | Reused passwords |
| Public paste sites and dark web markets | Credentials bought in bulk, often for a few dollars | Anything already stolen and resold |
| Network interception | Coffee-shop Wi-Fi, evil-twin hotspots, rogue access points | Unencrypted traffic on trusted networks |
| Physical access | Shoulder surfing, keyloggers on shared machines | Anything typed or visible |
Three channels dominate in 2026:
- Phishing pages with real-time proxies. Modern AiTM kits sit between the user and the real login page, capturing the password and the MFA approval in one session. Verizon's 2025 report records 1,057 CVEs exploited as initial access, and infostealer-led credential theft remains the most common way attackers get the keys in the first place.
- Info-stealers. Malwarebytes' June 2026 analysis describes infostealers becoming the go-to phishing payload: instead of a link to a fake login page, the message delivers a small program that empties the browser's saved passwords, cookies and session tokens (Malwarebytes, June 2026). One staff laptop can hand over credentials for every service it ever remembered.
- Reused passwords from third-party breaches. An attacker buys a dump of 100,000 leaked credentials and retries them against Microsoft 365, Xero and your VPN. The breach that "happened to someone else" becomes your incident.
What attackers do with harvested credentials
- Account takeover. Log into email, cloud storage or remote access as the real user. No alarms, because the login is genuine.
- Business email compromise. A hijacked mailbox is used to send payment-fraud requests from a trusted address, continuing real threads.
- Payroll and invoice fraud. A redirected pay run or a changed supplier bank detail — both read as ordinary administrative work.
- Ransomware entry. The stolen VPN or remote-desktop login is the foothold; the ransomware follows days later.
- Resale. Credentials are packaged and sold on dark-web markets, so a single breach can be exploited for months or years after the original theft.
The warning signs
- MFA prompts arriving when nobody is trying to log in
- Impossible-travel alerts: a login from another country minutes after a local one
- Mail rules nobody created, or deletion of sent items
- Password resets or MFA method changes nobody requested
- Colleagues receiving messages from a real address that the sender never sent
- Unfamiliar logins flagged by Microsoft 365 or Google Workspace security reports
Any one of these justifies an immediate password reset and session revocation for that account.
The controls that actually stop credential harvesting
- Multi-factor authentication everywhere, especially email and finance. A stolen password alone is not enough to get in. Prefer authenticator apps or hardware keys over SMS, which SIM-swap attacks can defeat.
- Password managers for all staff. Unique, generated passwords per service mean a breach elsewhere does not open your front door.
- Dark-web and breach monitoring. Know when your domain appears in a leak, before the attacker uses it.
- Conditional access and session controls. Restrict logins by device compliance and location so a stolen password from a foreign IP is rejected outright.
- Trained staff who report the phish. The click that starts most harvesting is a phishing email; simulations build the reflex to report before the damage starts.
- Never save work passwords in the browser. Enforce a company password manager so one infostealer infection cannot drain the lot.
- Least privilege and offboarding discipline. Leavers lose access the same day; service accounts hold only what they need.
If you want to know which of these is weakest in your business, a gap assessment gives a ranked answer instead of a guess.
FAQ
What is credential harvesting in simple terms? Collecting usernames, passwords and session tokens so an attacker can log into systems as a legitimate user, usually through phishing pages, info-stealer malware or reused passwords from other breaches.
Is credential harvesting the same as phishing? No. Phishing is one delivery method — often the fake login page. Credential harvesting is the outcome: the attacker ends up holding usable login details, whether they got them from a phishing page, malware or a third-party leak.
How do I know if my credentials have been harvested? Unrequested MFA prompts, impossible-travel login alerts, unfamiliar mail rules, or password-reset emails you never asked for. Services like Have I Been Pwned can also tell you if your email appears in known breaches.
Does MFA stop credential harvesting? It stops the most common form — a stolen password alone. It does not stop real-time proxy phishing kits that relay MFA approvals in real time, so combine MFA with trained staff, conditional access and password managers.
What should we do if a staff password is compromised? Reset it immediately, revoke all active sessions and refresh tokens, check mail rules and MFA methods for tampering, and review recent sign-in logs for the account.
Should staff save passwords in the browser? No. Info-stealer malware empties saved browser passwords in one go. A company password manager with MFA on the vault is the safer pattern.
One last thing
Run a dark-web check on your company domain this week — it takes minutes and tells you exactly which of your staff's credentials are already for sale. Then turn on MFA for the accounts that do not have it yet, starting with email and finance. Most credential-harvesting incidents fail against those two steps alone.