Credential harvesting

Credential harvesting is the collection of usernames and passwords at scale, usually by presenting a convincing replica of a real login page. The stolen credentials are rarely the objective in themselves; they are the raw material for account takeover, payment fraud and onward intrusion.

This library records 5 cases, including one campaign that reached more than 130 organisations from a single operation.

How the attack runs

1. A trusted login is chosen, typically the identity provider or webmail that gates everything else.
2. A replica page is built and hosted on a domain close enough to pass a glance.
3. Traffic is driven to it by email, SMS or a message that supplies a reason to sign in now.
4. Credentials are captured, and in many current campaigns the one-time code is captured too and replayed immediately.
5. Access is used quickly, before the code expires or the user reports it.

Documented cases

• The 0ktapus campaign (2022) lured employees to fake Okta login pages and harvested roughly 9,931 credentials and 5,441 one-time codes across 136 organisations, including Twilio, Cloudflare and Mailchimp.
• Unatrac Holding (2018, $11M): the finance chief entered Office 365 credentials on a fake Microsoft page, and the mailbox access enabled the fraud that followed.
• Twitter (2020): attackers telephoned employees posing as IT help desk and harvested VPN credentials.
• The 2016 DNC and Clinton campaign intrusion: spoofed Google security-alert emails phished more than 300 staff.
• Sony Pictures (2014): fake Apple ID verification emails harvested reused credentials.

How it differs from related techniques

Phishing is the delivery method; harvesting is the objective. MFA fatigue and account takeover are what typically follow. Spear phishing aims the same technique at one named person.

The control that would have stopped it

• Phishing-resistant MFA. Origin-bound authenticators cannot be replayed on an attacker-controlled page, which neutralises both the credential and the code.
• Never authenticate from a link. Navigate to the application independently.
• Password managers as a detection layer, since they refuse to autofill on a domain that does not match.
• Alert on impossible or unusual sign-in patterns, which is what limited the damage for several 0ktapus targets.
• Eliminate reuse. Sony shows the multiplier effect when one harvested password unlocks several systems.