Phishing (Credential Harvesting)

Overview

Phishing (Credential Harvesting) is a social engineering technique used by adversaries to obtain sensitive authentication information such as usernames and passwords. It plays a critical role in the initial access and credential acquisition phases of the attack lifecycle, enabling attackers to impersonate legitimate users and gain unauthorized entry into systems or networks.

Attack Objective

• Primary goal: Acquire valid user credentials to facilitate unauthorized access
• Attack lifecycle stages supported: Initial Access, Execution, Persistence, Privilege Escalation
• Advances attacker position by enabling lateral movement, evasion of authentication controls, and establishing footholds within target environments

How the Technique Works

Adversaries craft deceptive communications, often emails or messages, that direct victims to counterfeit login portals or forms designed to mimic legitimate services. When victims enter their credentials, these details are captured by the attacker. The harvested credentials are then used to authenticate to systems, bypass security controls, and escalate privileges within the compromised environment.

Common Methods & Variations

• Typical implementations include spear-phishing emails, SMS phishing (smishing), and voice phishing (vishing) targeting individuals or groups
• Variants exist across on-premises and cloud environments, targeting identity providers, webmail portals, VPNs, and other authentication gateways
• Adversaries may use living-off-the-land techniques by leveraging legitimate services for phishing delivery or employ custom phishing kits and infrastructure

Indicators of Compromise (IOCs)

• Unusual authentication attempts from new or unexpected IP addresses or geolocations
• Access to accounts shortly after phishing campaigns or suspicious email delivery logs
• Presence of phishing URLs, domains, or email addresses in network traffic or email gateways
• Alerts from identity and access management systems indicating anomalous login patterns

Detection Strategies

• Telemetry sources include email security gateways, web proxy logs, authentication logs, and endpoint detection systems
• Behavioral detection focuses on identifying anomalous login behavior, such as impossible travel or atypical access times
• Correlation of phishing email indicators with subsequent authentication events enhances detection accuracy

Mitigation & Prevention

• Implement multi-factor authentication (MFA) to reduce the impact of stolen credentials
• Deploy email filtering and anti-phishing technologies to block malicious messages
• Enforce strong password policies and regular credential audits
• Conduct user training and awareness programs to recognize phishing attempts
• Architect network segmentation and least privilege access to limit attacker movement post-compromise

Response Considerations

• Immediately disable or reset compromised accounts to contain access
• Investigate phishing campaign scope, affected users, and potential lateral movement
• Review authentication logs for suspicious activity and identify additional compromised credentials
• Enhance user awareness and update detection rules to prevent recurrence
• Apply patches and harden authentication infrastructure as needed

Related Techniques

• Credential Dumping – to extract credentials from compromised systems
• Brute Force – using harvested credentials to attempt access
• Valid Accounts – leveraging stolen credentials for persistence and lateral movement
• Phishing for Information – broader category encompassing other data harvesting

Mapping & References

• MITRE ATT&CK T1566 – Phishing
• MITRE ATT&CK T1078 – Valid Accounts
• Public advisories from cybersecurity organizations on phishing campaigns and credential theft
• Industry reports detailing phishing trends and detection methodologies