Credential Harvesting.

The collection of usernames, passwords, tokens, and other authentication secrets at scale, usually for later account takeover or sale. It belongs to the Identity & Access category of cybersecurity.

The collection of usernames, passwords, tokens, and other authentication secrets at scale, usually for later account takeover or sale.

Credential harvesting is the systematic capture of authentication data — passwords, session tokens, MFA codes, API keys — through phishing pages, malicious browser extensions, infostealer malware, or breaches of poorly protected databases. The stolen credentials are then validated by credential-stuffing scripts, used in account takeover, sold on criminal markets, or leveraged for follow-on intrusions like business email compromise. Modern infostealers such as Lumma or RedLine harvest browser-stored credentials, cookies, crypto wallets, and authenticator seeds in seconds. Defences include phishing-resistant MFA (FIDO2, passkeys), unique passwords stored in a manager, conditional access policies, EDR against infostealers, and monitoring of leaked-credential feeds like Have I Been Pwned.

Defences for Credential Harvesting typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Credential theft, Password harvesting.