Credential harvesting is the collection of usernames, passwords and other login data through fake sites or forms so attackers can take over real accounts.
Credential harvesting is the practice of tricking people into entering their usernames, passwords and other login details on a page the attacker controls. It is the most common goal of a phishing site: the stolen credentials are used to take over accounts, resold, or tested against other services where people reuse the same password.
How it works
The attacker builds or buys a fake login page, usually from a phishing kit, and drives traffic to it with emails, text messages, ads or social media posts. When the victim submits the form, the data is stored or forwarded, and the victim is often redirected to the real site so nothing seems wrong. More capable setups also ask for the one-time code from an authenticator app or SMS and use it straight away. AiTM phishing goes further and captures the session itself.
Harvested data commonly includes:
- email addresses, usernames and passwords;
- one-time codes and security question answers;
- card numbers, national ID numbers or other personal details collected on follow-up pages.
Example
As an illustration, an employee receives an email saying a shared document is waiting for them. The link opens examplecorp-docs[.]com, which shows a copy of the company's single sign-on page. After the password is entered, an error message appears and the browser redirects to the genuine portal. The employee assumes it was a glitch, while the attacker already has a working password.
How to spot it
- A login page reached from an unexpected message rather than by typing the address.
- A domain that resembles the brand but is not the one it normally uses.
- A "wrong password" error on the first try, followed by a redirect to the real site.
- Requests for more data than a normal login needs, such as card or ID details.
- Password managers that do not offer to fill in the saved credentials.
What brands can do
Get harvesting pages offline quickly, because every hour they stay up means more stolen accounts. Report them to the host, the registrar and blocklists, and keep evidence for each step. Encourage phishing-resistant sign-in such as passkeys or security keys, and watch for unusual login patterns after a campaign. Tell customers clearly how your real login pages look and where they live. If you need help with verification and phishing takedown, Phishvoid can take this on.
Read more: How to Spot a Phishing Website: 10 Warning Signs
Seeing this against your brand?
We find and take down phishing and impersonation sites. Tell us what you are seeing.