Look for legitimate sites serving unexpected client-side scripts, unusual redirects to verification pages, and spikes in authentication activity that do not match user intent. If only a subset of visitors is affected, the campaign may be trying to stay below the threshold that triggers broad security attention.
What makes a watering-hole credential campaign visible in practice?
The clearest signal is a mismatch between normal user behavior and what the site is trying to do. A compromised legitimate site may load new or unexpected client-side code, trigger redirects that feel like verification or re-authentication, and cause login attempts that cluster around a specific audience rather than the whole visitor base.
Because the site itself is trusted, the campaign often blends into routine browsing and only becomes obvious when you compare page behavior, authentication telemetry, and user reports side by side.
That pattern aligns with the kind of credential abuse described in the CISA Known Exploited Vulnerabilities Catalog when active exploitation is already underway, and with attacker tradecraft mapped in the MITRE ATT&CK Enterprise Matrix around credential access and follow-on abuse.
Which telemetry usually separates a live campaign from benign site change?
Look for changes that affect the browser path more than the server path. Examples include injected JavaScript, odd third-party script hosts, new form handlers, or redirection chains that only appear for selected users, geographies, or referrers. Those are the kinds of details that suggest the site is being used as a delivery point rather than simply being compromised in the abstract.
Authentication logs help confirm whether the traffic is opportunistic or targeted. A watering-hole credential campaign often produces spikes in failed logins, token refreshes, MFA prompts, or session creation that do not fit the normal rhythm for that application. If the activity is concentrated in a narrow user cohort, the attacker may be validating victims quietly instead of blasting every visitor.
When the credential material is API-oriented or machine-oriented, the same logic applies to key or token use, not just password prompts. API Key Management Guide and Secrets Management Guide are useful companions here because they frame how exposed credentials behave once they are being probed or reused. The broader identity context is also covered by Ultimate Guide to NHIs, What are Non-Human Identities, which helps when the campaign targets non-human logins rather than human users.
How should defenders interpret partial targeting and low-and-slow behavior?
A limited blast radius is often intentional. Attackers may only arm the page for visitors who match a target profile, such as a corporate network, a language setting, a region, or a browser fingerprint that suggests the right organization. That makes the campaign harder to notice because most users see nothing unusual, while the intended subset experiences the credential trap.
The most important judgment is to treat inconsistency as evidence, not noise. If a site that normally behaves predictably begins serving different client-side content to different visitors, or if authentication requests appear only after a browser-side redirect, assume the page is part of an active operation until you can explain the variation. Hugging Face Spaces breach 2024 and The State of NHI & AI Agent Breach Report 2026 both reinforce a practical point: once trust in a legitimate interface is abused, credential theft often starts with subtle changes in normal user flow.
Risk and Threat Considerations
Watering-hole credential campaigns are dangerous because they weaponise a trusted destination. The site may look normal to most users, which lets the attacker keep the operation quiet while selectively harvesting credentials, session material, or MFA interactions from the intended victims.
Failure mechanism: The attacker compromises or controls a legitimate site, injects browser-side logic, and uses redirect or verification steps to capture credentials or trigger authentication events from a narrow target set.
Impact: Victims can lose accounts, sessions, or tokens before broad detection triggers, and the site can become a repeatable access path for follow-on compromise across one organization or user cohort.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 define the specific risk controls and attack patterns relevant to this topic.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1189 — Drive-by Compromise | Watering-hole delivery uses a trusted site to reach selected victims. |
| T1056 — Input Capture | Credential campaigns often rely on browser-side capture of secrets or logins. | |
| T1071 — Application Layer Protocol | Selective redirects and web-based exfiltration commonly use normal web traffic paths. | |
| Recommendation — Map the site compromise to drive-by delivery and hunt for injected browser-side payloads. Inspect for client-side credential harvesting and unusual form or script interception. Trace suspicious redirect and submission flows over application-layer traffic. | ||
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | Credential campaigns aim to expose tokens, keys, or other secret material. |
| NHI-07 — Long-Lived Secrets | Stolen credentials remain useful longer when they do not expire quickly. | |
| Recommendation — Assume any captured secret is compromised and rotate it immediately. Prefer short-lived credentials and revoke any long-lived secret touched by the campaign. | ||
Practitioner Guidance
What to verify: Confirm whether the unexpected script or redirect is present only for selected visitors, because that is often the difference between a routine site issue and an active watering-hole operation. Correlate web telemetry with identity logs so you can see whether browser anomalies and authentication anomalies line up.
Decision rule: If the same site behaves differently for different users, treat it as a security event first and a web defect second. Preserve the original page content, redirect chain, and affected account timelines before you attempt cleanup, because those details are what prove the campaign path.
Practitioner takeaway: The strongest indicator is not a single bad page load, but a consistent mismatch between who should be seeing the site and who is being pushed into authentication.
Related resources from NHI Mgmt Group
- What are the signs that an infostealer campaign is active on a workstation before exfiltration occurs?
- What are the signs that active credential monitoring is not working?
- What are the signs that an account takeover campaign is extending beyond initial credential theft?
- What are the signs that a router-based intrusion campaign is active in an environment?