Technique

Credential Theft

Also known as: Password Theft, Credential Harvesting, Password Stealing, Login Theft, Account Credential Compromise

COMPROMISE

Obtaining login credentials through phishing, fake websites, keyloggers, data breaches, or social engineering tricks, allowing attackers to access victims' accounts and sensitive information.

Common attack flows

How it fits in a scam

This technique shows up duringCOMPROMISE

Before

After

Defense

How to defend against this

How to spot it

  • Unexpected password reset emails you didn't request
  • Login alerts from unfamiliar devices or locations
  • Locked out of accounts without explanation
  • Browser warnings about compromised passwords (Chrome; Edge; Safari built-in alerts)
  • Breach notification alerts from services like Have I Been Pwned
  • Two-factor authentication prompts you didn't initiate
  • Unknown devices listed in your account security settings

Tools you can use

Seen in the wild

Where we’ve seen it

Commonly targets

Further reading