Credential harvesting vs phishing, in plain English: phishing is the bait that shows up, an email or a text pretending to be someone it isn’t. Harvesting is what the crooks hope to walk away with. Your username, your password, that six-digit code, maybe the cookie that keeps you signed in. Usually it gets typed into a fake login page.
They overlap a lot but they aren’t the same thing. Some phishing just wants you to open an attachment or wire money. And plenty of stolen logins never came from a phishing message at all; they were bought, or lifted by malware.
| Phishing | Credential harvesting | |
|---|---|---|
| What it is | A deceptive message: email, text, chat | Capturing login details or session tokens |
| Other possible goals | Malware, payments, data | None; logins are the point |
| Usual tool | A convincing message | A look-alike login page, or malware that steals cookies |
| When the damage shows | Often right away | Sometimes weeks later, when the login is reused |
| A case from this library | Target (2013): an email that led to a vendor login being stolen | 0ktapus (2022): about 9,931 logins collected from fake Okta pages |
| What stops it | Filters, checking requests another way | Security keys or passkeys, plus sessions tied to one device |
Key takeaways
Here’s the awkward bit. A harvested password might sit in a dump for weeks, get sold on, then get tried by a completely different crew against a completely different system. By the time someone breaks in with it, that text from a month ago is long forgotten.
So security teams split the problem in two. Job one: stop the message. Job two: make sure a stolen login is worthless even if job one fails.
Staff at firms that log in through Okta started getting texts “from IT”: your password’s expired, your schedule’s changed, tap here. The link went to a look-alike Okta page. One campaign, and by the end it had roughly 9,931 credentials and 5,441 MFA codes tied to 136 corporate email domains. That access then got used against other companies further down the chain. Full case: 0ktapus campaign.
Hackers said they bought a stolen Slack session cookie for $10. It put them inside EA’s Slack as a user who was already logged in, so there was no password or MFA prompt to get past. They then asked IT support for a new MFA token, posing as an employee who’d lost a phone. Full case: EA data breach.
In a case documented by AT&T Cybersecurity, now LevelBlue, a PDF dressed up as a Microsoft MFA setup notice carried a QR code. Several employees scanned it and typed their credentials into a fake Microsoft page. Full case: fake MFA setup QR code.
Tip: got a login page right after tapping a link or scanning a code? Close it. Open the app, or type the address in yourself. If the request was real, it’ll still be waiting for you there.
More detail lives on the credential harvesting page. For the delivery side, browse the phishing cases.
No. Phishing is the deceptive message. Credential harvesting is collecting logins, which phishing often aims to do. Malware, data leaks and bought cookies are other routes to the same goal.
Most often with a fake login page reached from a phishing email, text or QR code. Others use malware that steals saved passwords and session cookies, or buy logins that were stolen earlier.
Some types of MFA. Codes sent by text or shown in an app can be harvested too, as 0ktapus showed. Phishing-resistant MFA like FIDO2 security keys and passkeys won’t work on a fake site, so there’s nothing useful to steal.
Change it on the real site straight away, and anywhere else you use it. Sign out of other sessions if the service allows it. At work, tell your security team, because a harvested login can be used within minutes.
Reviewed by the SEE Team on 22 October 2026; every case linked here has its sources on its own page. How pages are researched and fact-checked. About Social Engineering Examples.
Social Engineering Examples