Credential Theft

What it is

Credential theft is the stealing of information that proves identity to a service. It includes passwords and may also involve API keys, recovery codes, or authentication tokens. It differs from guessing: even a long random password can be captured by a fake login page or malware. Theft may precede an account takeover rather than being noticed immediately.

How it works

A phishing form records what you type, an infostealer reads accessible device data, or a breached service exposes credentials. Attackers can then sell or replay them. A malicious app may capture information as you enter it, while a stolen session token can sometimes grant access without another password prompt.

How people get tricked

You may trust a cloned sign-in page or a download that appears useful. Saving a password in a browser is not by itself evidence of insecurity, but a compromised device can undermine protections that work normally when the device is trusted.

Example scenario

A fake collaboration message captures your work login and code. The attacker signs in before you realize the document does not exist, then creates a persistent session.

Warning signs

• A verified breach or endpoint alert reports stolen credentials.
• Login prompts appear on an unexpected domain or at an unusual stage.
• Unfamiliar sessions or recovery changes follow a suspicious download.

If it happens to you

Use a clean device to rotate exposed secrets, including reused passwords. Revoke sessions and review connected applications; a password change may not terminate every token. If malware was involved, remediate or rebuild the affected device before entering new credentials there.