Credential harvesting vs phishing: what is the difference?

Phishing is the delivery method: a deceptive message. Credential harvesting is one of its goals: capturing usernames, passwords and session tokens at scale, usually through a convincing fake login page. Phishing is how it arrives, harvesting is what it collects.

The separation is useful because harvesting has a distinctive aftermath. A harvested credential is often used weeks later, by a different actor, against a different system, so the incident does not look like the phishing email that caused it.

Documented cases

• 0ktapus harvested roughly 9,931 credentials and 5,441 MFA codes across 136 organisations from a single SMS campaign.
• EA Games shows the token side: a stolen session cookie bought for about $10 gave access to internal Slack, with no password involved.
• LevelBlue documents QR-code lures aimed at the MFA enrolment step.

The control that breaks it

• Deploy phishing-resistant MFA. Harvested passwords and one-time codes stop being useful.
• Bind sessions to a device, since 0ktapus and the EA case show tokens are the real target.
• Shorten session lifetimes on sensitive systems.
• Watch for impossible-travel and new-device sign-ins, which is where late reuse surfaces.

Related: spear phishing vs phishing · Credential harvesting