Credential Harvesting

Glossary

What Is Credential Harvesting? Credential harvesting is the systematic collection of usernames, passwords, API keys, tokens, and other authentication material through deception, exploitation, or direct extraction. Attackers use harvested credentials to gain unauthorized access to systems, applications, and data, often without triggering security alerts because the access appears legitimate. A credential harvesting attack is rarely the end goal. It is the enabling step for lateral movement, data exfiltration, and persistent access. Once an attacker holds valid credentials, they bypass perimeter defenses entirely because the authentication layer treats them as a trusted user. This makes credential harvesting one of the most consequential threats in modern application security. ## Key Takeaways - Credential harvesting collects authentication material through phishing, malware, code exposure, or infrastructure exploitation. - Harvested credentials enable account takeover attacks, lateral movement, and data exfiltration under the cover of legitimate access. - Techniques like memory extraction pull stored credentials directly from compromised systems, providing reusable authentication material for lateral movement. - [Hardcoded secrets](/glossary/hardcoded-secrets) and API keys in source code are a primary harvesting target that developers frequently underestimate. - Detection requires monitoring for credential misuse patterns, not just preventing the initial harvesting event. ## The Methods Attackers Use to Harvest Credentials Attackers employ a range of techniques to collect credentials, each targeting a different layer of the technology stack. Common methods include: - Phishing and social engineering: Phishing credential theft uses fake login pages, email lures, and impersonation to trick users into submitting credentials to attacker-controlled infrastructure. This remains the highest-volume harvesting method. - Credential dumping: Extracts authentication material directly from operating system memory, credential managers, browser storage, or registry hives on already-compromised systems. Tools like Mimikatz target Windows LSASS process memory to pull plaintext passwords and Kerberos tickets. - Keylogging and infostealers: Malware installed on endpoints records keystrokes or monitors clipboard content to capture credentials as users type them. - Man-in-the-middle interception: Attackers position themselves between users and legitimate services to intercept credentials in transit, particularly on networks using weak or misconfigured TLS. - Code and configuration exposure: Credentials committed to source code repositories, stored in plaintext configuration files, or embedded in CI/CD pipeline definitions are directly accessible to anyone with read access. ## How Credential Harvesting Fits Into a Broader Attack Chain A credential harvesting attack is typically the first phase of a multi-stage intrusion. The attacker's workflow follows a predictable progression. The initial harvest provides a foothold: valid credentials to a single account or service. The attacker uses that access to map the environment, identify high-value targets, and discover additional credentials stored in accessible locations. This internal harvesting cycle compounds the initial breach. An account takeover attack using harvested credentials often goes undetected for weeks or months because the access pattern matches normal user behavior. The attacker logs in from expected locations, accesses expected resources, and avoids the anomalous behavior that triggers security alerts. The downstream impact scales with the privilege level of the harvested credentials. Compromising a developer account with access to source code repositories, cloud consoles, and CI/CD pipelines creates a different blast radius than compromising a general business user. Organizations that detect and prevent [application security vulnerabilities](/glossary/application-security-vulnerability) early in the development lifecycle reduce the surface area available for post-harvest exploitation. ## Why Credentials Exposed in Code Are a Critical Harvesting Target [Hardcoded credentials](/glossary/hardcoded-credentials) in source code represent one of the most direct harvesting vectors. API keys, database connection strings, service account passwords, and OAuth tokens embedded in application code or configuration files are accessible to anyone with repository access, including external attackers who gain access through a compromised developer account. The risk compounds in several ways. Credentials committed to version control persist in Git history even after the offending file is deleted. Forked repositories carry the exposed credentials into new environments. CI/CD logs and build artifacts may contain credentials that were injected as environment variables but logged during debugging. Teams managing secrets in code need automated [secrets detection](/glossary/secrets-detection) that scans repositories, pipeline configurations, and infrastructure templates continuously. Manual code review cannot keep pace with the volume of changes in modern development environments. ## How Apiiro Detects Hardcoded and Exposed Credentials Across the Codebase Apiiro scans every code change across repositories, CI/CD pipelines, and configuration files to detect exposed credentials and secrets. Its deep code analysis identifies hardcoded API keys, tokens, passwords, and connection strings at the point of commit, before they propagate through the development lifecycle. When Apiiro flags an exposed credential, it provides the full context: which repository, which file, when it was introduced, who committed it, and whether the affected code is deployed to production. This code-to-runtime correlation helps security teams assess the actual exposure risk and prioritize remediation based on business impact rather than treating every exposed secret with equal urgency. ## FAQs ### What is the difference between credential harvesting and credential dumping? Credential harvesting is the broad category covering all methods of collecting authentication material, including phishing, social engineering, and code exposure. Credential dumping is a specific technique that extracts stored credentials from operating system memory, credential managers, or registry hives on already-compromised systems. ### How do attackers use harvested credentials once they have them? Attackers use harvested credentials for initial access, lateral movement, privilege escalation, and persistent access. They log in as legitimate users to avoid detection, access sensitive data and systems, escalate privileges where possible, and establish backup access through additional compromised accounts or planted backdoors. ### Can credential harvesting occur without a user clicking on a phishing link? Yes. Credential dumping from compromised systems, extraction from exposed source code repositories, interception through man-in-the-middle attacks, and harvesting from misconfigured cloud storage all occur without phishing. Any method that accesses stored or transmitted credentials qualifies as harvesting. ### How do you detect that credentials have been harvested before an attacker uses them? Detection focuses on early indicators: unexpected access to credential stores, anomalous repository access patterns, alerts from secrets scanning tools, and intelligence on compromised credentials from breach databases. Monitoring for phishing credential theft infrastructure, such as newly registered lookalike domains, provides pre-exploitation warning.