Credential Theft

Overview

Credential theft occurs through phishing, malware, social engineering, database compromise, session hijacking, insider access, device theft, browser extensions, exposed repositories, or interception. Attackers may target primary credentials or the recovery process that can replace them.

Stolen credentials can be used immediately, sold, or retained for later access. Changing one password may be insufficient when active sessions, refresh tokens, API keys, connected applications, or recovery methods remain under attacker control.

Response should revoke sessions and related credentials, investigate activity, secure recovery channels, notify affected parties appropriately, and correct the theft path. Phishing-resistant authentication, hardware-backed keys, least privilege, secret scanning, and behavioral monitoring reduce impact. Detection should cover both interactive and programmatic access.

Credential theft is the deliberate acquisition of passwords, keys, tokens, session data, or recovery factors for unauthorized access or impersonation. Credential theft response must remove every persistence path, not merely replace the first password known to be compromised.

For Credential Theft, the trust decision should establish the deliberate acquisition of passwords, keys, tokens, session data, or recovery factors for unauthorized access or impersonation and bind the result to the requested action and protected resource. Teams should test issuance, storage, validation, expiry, revocation, recovery, and privileged override for deliberate acquisition of passwords, keys, and tokens, rather than checking only a successful request. Logs concerning the Credential Theft context and deliberate acquisition of passwords, keys, and tokens should support investigation without exposing reusable secrets or unnecessary personal data.

Review of Credential Theft should compare permitted and rejected actions related to deliberate acquisition of passwords, keys, and tokens, confirm that recovery cannot bypass the primary safeguard, and remove obsolete access promptly.