Credential Harvesting.

What is credential harvesting?

Credential harvesting means gathering login details at scale or from many sources. The details can be usernames, passwords or other data that proves who a user is. MITRE ATT&CK does not define one single technique with this exact name. It describes several techniques that collect credentials, and this page groups them under the common name.

How does credential harvesting work?

CISA says phishing attacks use email or malicious websites to solicit personal information by posing as a trustworthy organization. MITRE describes related methods.

• Input capture: MITRE says adversaries may use methods of capturing user input to obtain credentials or collect information. Its sub-techniques include keylogging, GUI input capture, web portal capture and credential API hooking.
• Browser stores: MITRE says adversaries may acquire credentials from web browsers by reading credential store files, and may also search browser process memory for credential patterns.

Why does it matter?

MITRE says input capture cannot be easily mitigated with preventive controls, since it is based on the abuse of system features. Reasoning cautiously, this suggests that layered habits and monitoring matter, not one single control.

How can you reduce the risk?

These points come from CISA and MITRE. They are not a complete defense.

• Refrain from sharing sensitive information by email or following links in email, says CISA.
• Verify a suspicious request by contacting the organization independently, says CISA.
• Use anti-virus software, firewalls and email filtering, use the anti-phishing protections built into email and browsers, and enable multi-factor authentication, says CISA.
• Consider weighing the risk of storing credentials in web browsers, says MITRE.
• Give users training on secure practices for managing credentials, says MITRE.
• Regularly update web browsers, password managers and related software, says MITRE.
• Monitor for non-browser processes accessing browser credential stores. MITRE lists this as a detection idea.

Is credential harvesting the same as phishing?

No. Phishing is one method that can be used to collect credentials. Credential harvesting describes the goal, and phishing is one of several ways to reach it.

Is credential harvesting the same as credential stuffing?

No. Harvesting is about collecting credentials. Stuffing, in general usage, means trying credentials that were already exposed against other accounts.

Related terms

See also credential theft, phishing and leaked credentials.

Related pages in the Knowledge Hub

• Credentials from Password Stores

Sources

• MITRE ATT&CK: MITRE says adversaries may capture user input to obtain credentials; sub-techniques include keylogging, GUI input capture, web portal capture and credential API….
• CISA: CISA says phishing uses email or malicious websites to solicit information while posing as a trustworthy organization, and lists protective steps.
• MITRE ATT&CK: MITRE says adversaries acquire credentials from web browsers by reading credential store files; lists mitigations and detection.