Credential theft is the stealing of account names, passwords and similar login material so that someone else can use them. MITRE ATT&CK groups the related techniques under its Credential Access tactic. It covers many methods, from dumping stored credentials to intercepting them.
- Also Called3other namescredential stealing · stolen credentials · credential access
- Related Terms1linked entries
What is credential theft?
Credential theft is the stealing of account names and passwords, or similar login material, so that someone else can use them. MITRE ATT&CK describes its Credential Access tactic as the adversary trying to steal account names and passwords. MITRE says this tactic consists of techniques for stealing credentials like account names and passwords. ATT&CK is MITRE’s public catalog of attacker behavior.
What counts as a credential?
NIST defines a credential as an object or data structure that binds an identity, through an identifier, and optionally extra attributes, to at least one authenticator that a subscriber possesses and controls. An authenticator is something used to prove who you are. In everyday use, an account name and password pair is the most familiar example.
Why do attackers want stolen credentials?
MITRE says that using legitimate credentials can give adversaries access to systems, make them harder to detect, and give them the chance to create more accounts to help achieve their goals. A simple illustration: a valid login can look like normal use of an account, which is why stolen credentials matter to an attacker.
How does credential theft work?
MITRE lists many techniques under the Credential Access tactic. The first twelve on its tactic page include these, among others:
- Adversary-in-the-Middle (T1557)
- Brute Force (T1110)
- Credentials from Password Stores (T1555)
- Input Capture (T1056)
- Multi-Factor Authentication Interception (T1111)
- Multi-Factor Authentication Request Generation (T1621)
- Network Sniffing (T1040)
- OS Credential Dumping (T1003)
What is OS credential dumping?
MITRE says adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. A hash is a scrambled form of a password. MITRE lists these sub-techniques: LSASS Memory, Security Account Manager, NTDS, LSA Secrets, Cached Domain Credentials, DCSync, Proc Filesystem, and /etc/passwd and /etc/shadow.
How can credential theft be reduced?
For OS credential dumping, MITRE lists these mitigations:
- Active Directory Configuration
- Behavior Prevention on Endpoint
- Credential Access Protection
- Encrypt Sensitive Information
- Operating System Configuration
- Password Policies
- Privileged Account Management
- Privileged Process Integrity
- User Training
Is credential theft the same as Credential Access?
Almost. Credential Access is the name MITRE gives to the tactic, which is the attacker’s goal of stealing credentials. Credential theft is the plain-language name for the same idea. The techniques are the different ways of reaching that goal.
Is credential theft the same as OS credential dumping?
No. OS credential dumping is one technique within Credential Access. Credential theft is the wider idea, and MITRE lists many other techniques under the same tactic.
How does it relate to other terms?
Related entries include account takeover, multi-factor authentication and brute force attack. Each has its own page in this glossary.
Latitude Financial said in 2023 that the attacker in its data theft case obtained employee login credentials.
Also Called.
- Namecredential stealing
- Namestolen credentials
- Namecredential access
Questions.
-
What is credential theft?
Credential theft is the stealing of account names, passwords and similar login material so that someone else can use them. MITRE ATT&CK groups related techniques under its Credential Access tactic. The tactic covers many methods, from dumping stored credentials to intercepting them.
-
Why do attackers want stolen credentials?
MITRE says legitimate credentials can give adversaries access to systems, make them harder to detect, and let them create more accounts to help achieve their goals.
-
What is OS credential dumping?
MITRE says adversaries may dump credentials to obtain account login material, normally a hash or a clear text password. A hash is a scrambled form of a password.
-
How can credential theft be reduced?
For OS credential dumping, MITRE lists mitigations such as password policies, privileged account management, credential access protection, user training and encrypting sensitive information. These are listed on MITRE's technique page.
Sources
In Our Research
- 1 APT19 (DEEP PANDA): A Persistent China-Aligned Espionage and Credential Theft Actor March 2026
- 2 GRU targeting of logistics firms: advisory AA25-141A October 2026
- 3 Passwordless Is Not Takeover Proof: Where Passkey Attacks Actually Land September 2026
- 4 Agentic Ransomware: What Happens When Malware Doesn’t Need a Human Operator to Decide Who to Hit Next? September 2026
- 5 AI Gateway Exploitation: How Attackers Are Targeting LiteLLM, RAGFlow, and Kestra to Steal Your Model Provider Keys August 2026
- 6 Top 5 Ransomware Groups in Q2 2026: Who They Are, How They Operate, and What They Target July 2026