Credential Harvesting.

What Is Credential Harvesting?

Credential harvesting means gathering login details at scale or from many sources. The details can be usernames, passwords or other data that proves who a user is. MITRE ATT&CK does not define one single technique with this exact name. It describes several techniques that collect credentials, and this page groups them under the common name.

How Does Credential Harvesting Work?

CISA says phishing attacks use email or malicious websites to solicit personal information by posing as a trustworthy organization. MITRE describes related methods.

• Input capture: MITRE says adversaries may use methods of capturing user input to obtain credentials or collect information. Its sub-techniques include keylogging, GUI input capture, web portal capture and credential API hooking.
• Browser stores: MITRE says adversaries may acquire credentials from web browsers by reading credential store files, and may also search browser process memory for credential patterns.

Which Techniques Does MITRE List for Collecting Credentials?

No single ATT&CK entry is called credential harvesting. These five entries show the common routes, from the fake email to the stolen cookie. They connect to phishing, adversary-in-the-middle attacks and leaked credential monitoring.

Why Is Input Capture Hard to Block?

MITRE says input capture cannot be easily mitigated with preventive controls, since it is based on the abuse of system features. Layered habits and monitoring matter more than one control.

What Do CISA and MITRE Advise?

These points come from CISA and MITRE. They are not a complete defense.

• Refrain from sharing sensitive information by email or following links in email, says CISA.
• Verify a suspicious request by contacting the organization independently, says CISA.
• Use anti-virus software, firewalls and email filtering, use the anti-phishing protections built into email and browsers, and enable multi-factor authentication, says CISA.
• Consider weighing the risk of storing credentials in web browsers, says MITRE.
• Give users training on secure practices for managing credentials, says MITRE.
• Regularly update web browsers, password managers and related software, says MITRE.
• Monitor for non-browser processes accessing browser credential stores. MITRE lists this as a detection idea.

Is Credential Harvesting the Same as Phishing?

No. Phishing is one method that can be used to collect credentials. Credential harvesting describes the goal, and phishing is one of several ways to reach it.

Is Credential Harvesting the Same as Credential Stuffing?

No. Harvesting is about collecting credentials. Stuffing means trying credentials that were already exposed against other accounts. Read more in our post on credential stuffing.

Related Terms

See also credential theft, phishing and leaked credentials.

Related Pages in the Knowledge Hub

• Credentials from Password Stores

Sources

• MITRE ATT&CK: MITRE says adversaries may capture user input to obtain credentials; sub-techniques include keylogging, GUI input capture, web portal capture and credential API hooking.
• CISA: CISA says phishing uses email or malicious websites to solicit information while posing as a trustworthy organization, and lists protective steps.
• MITRE ATT&CK: MITRE says adversaries acquire credentials from web browsers by reading credential store files; lists mitigations and detection.
• MITRE ATT&CK: MITRE describes spearphishing with a malicious link.
• MITRE ATT&CK: MITRE describes capturing credentials on externally facing portals.
• MITRE ATT&CK: MITRE describes adversary-in-the-middle positioning.
• MITRE ATT&CK: MITRE describes stealing web session cookies.