Credential harvesting turns shared-device access into breach risk

At a glance

What this is: NHI Mgmt Group's analysis, drawing on OLOID's blog post: Credential harvesting scales by collecting usernames, passwords, session tokens and cookies, and shared-device workflows make that activity harder to distinguish from legitimate use.

Why it matters: IAM and security teams need to treat credential capture as an access problem, not only a phishing problem, because stolen credentials can bypass perimeter controls and undermine shared-session accountability.

By the numbers:

• Leaked credentials surged 160% in 2025 compared to the year before, according to Check Point External Risk Management research cited by OLOID.

Context

Credential harvesting is not a malware-only problem. It is the collection of authentic login material at scale, then reuse of that material to enter systems as if the attacker were the real user. That matters for identity governance because the control failure happens at authentication, not at the firewall.

Shared-device environments expose the weakest version of the one-person-one-session assumption. When multiple workers use the same terminal across a shift, the environment can hide stolen credential use inside ordinary access patterns, which makes session attribution and anomaly detection materially harder. shared-device identity security is where this problem becomes most visible.

Key questions

Q: How should security teams detect credential compromise before it turns into account takeover?

A: Teams should correlate authentication events with post-login behaviour, privilege use, and session context. A single successful login is not enough to prove legitimacy. The useful question is whether the session behaves like the real user or identity, especially when device, location, timing, and action sequence all shift at once.

Q: Why do stolen credentials still matter in environments with MFA?

A: Stolen credentials matter because they are often the first step in a chain that ends with social engineering or MFA fatigue. Once the attacker has a valid username and password, they only need one weak factor or one confused user. MFA reduces risk, but it does not remove the value of credential theft as an entry method.

Q: How should shared-device environments handle identity verification at login?

A: Shared-device environments should verify the individual at each login with strong authentication, then bind the session to that person’s account and device posture. Use MFA, step-up checks for risky sign-ins, short session lifetimes, and automatic sign-out on inactivity. Avoid cached passwords, shared browser profiles, and reusable local accounts so the verified individual cannot inherit another person’s access.

Q: What is the best way to reduce credential reuse across applications?

A: The best way to reduce credential reuse across applications is to issue unique credentials per application, with separate service accounts, API keys, tokens, or certificates for each workload. Pair that with secret storage, scoped permissions, automated rotation, and revocation on offboarding. Reuse creates a single compromise path across systems and makes ownership and audit trails unclear.

Technical breakdown

Why stolen credentials defeat perimeter controls

A stolen credential works because most enterprise systems still trust successful authentication as evidence of legitimate intent. Once an attacker has a valid username-password pair, they do not need to break the perimeter in the traditional sense. They inherit the user's access path, including applications reached through SSO and any downstream systems that trust that identity provider. The core issue is not password strength alone but the fact that authentication artefacts can be copied, replayed, intercepted or bought and then used to impersonate the account holder. See the API Key Management Guide.

Practical implication: Treat every authentication event as a potential ingress point and tighten the controls that validate the session, not just the password.

Why shared terminals hide compromise

In a shared-device workflow, several identities can flow through one endpoint during a single shift. That breaks device-centric monitoring because the hardware stays constant even while the user changes. The result is a flattened signal set: login location, device fingerprint and endpoint posture can all look normal while the identity behind the session is not. This is why identity-layer telemetry matters more than device-level telemetry when the same terminal is used by a rotating workforce. See the Workforce Identity Security Guide.

Practical implication: Move detection and session accountability to the identity layer where the user, not the terminal, is the meaningful unit of control.

How credential stuffing turns one breach into many

Credential stuffing is the automated reuse of previously stolen username-password pairs against other services. It succeeds because password reuse collapses the distance between a consumer breach and an enterprise login, especially when SSO or weak password hygiene is present. The attacker is not guessing randomly. They are testing known-valid combinations at scale and waiting for one environment where the same credential still opens the door. See the Password Security and Password Manager Guide.

Practical implication: Limit credential reuse impact by treating stolen credentials as reusable assets in an attacker inventory, not isolated account events.

Threat narrative

Attacker objective: The objective is to obtain authenticated access that looks legitimate enough to bypass perimeter controls and enable deeper compromise inside the environment.

1. Entry begins when a target enters credentials into a convincing phishing page, a spoofed login portal, or another harvesting channel that captures the secret instead of merely displaying it.
2. Credential access follows immediately because the attacker now holds valid authentication material, including passwords, session tokens or cookies that can be replayed as the real user.
3. Escalation occurs when the attacker uses the authenticated session to map reachable systems, pivot through trust relationships or abuse access that appears legitimate to downstream controls.
4. Impact comes from data theft, ransomware, persistence or further account takeover, with the original compromise often blending into normal login activity for an extended period.

Breaches seen in the wild

• Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.
• 23andMe credential stuffing 2023: Credential stuffing into 18,000 accounts exposed nearly 7 million people through the DNA Relatives feature.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Credential harvesting is an identity control failure, not just a user-behaviour problem. The attacker wins when the environment treats a captured secret as proof of the right person, even after that secret has been copied elsewhere. That is why perimeter-first thinking misses the point: the breach begins at authentication, then expands through the trust that follows the login. The practitioner conclusion is to govern credentials as reusable access artefacts, not as static proof of identity.

Shared-device workflows create credential ambiguity that conventional IAM assumes away. Most identity programmes are built around a stable mapping between person, device and session. In frontline operations that mapping breaks, so the programme must account for access that is sequential rather than personal. Static vs dynamic secrets is useful here because the same lifecycle logic that applies to secrets applies to shared-session trust. The practitioner conclusion is that session attribution has to be designed for turnover, not just for login success.

Credential stuffing is the point where weak password hygiene becomes a systemic access risk. Reuse makes one exposed credential economically useful across many services, which is why password policy, reset cadence and account recovery all become part of the attack surface. The field-level lesson is that identity compromise scales when governance treats each login as independent instead of treating reused credentials as correlated risk. The practitioner conclusion is to model exposure across accounts, not one account at a time.

Passwordless authentication changes the control boundary by removing the harvestable secret. When the credential itself is gone, the attacker loses the easiest object to copy, replay or sell. That does not end all identity abuse, but it collapses the harvest-and-reuse pattern that makes credential-based compromise so durable. The practitioner conclusion is that authentication architecture, not just awareness, determines whether harvesting remains profitable.

What this signals

Credential harvesting is most damaging where access and identity are already blurred. Frontline and shared-terminal environments need controls that prove who is present for a session, not merely who knows a password. That means treating authentication architecture as part of operational governance, not a separate security layer.

Passwordless authentication is the cleanest way to reduce harvestable surface in shared workflows. When there is no reusable password to steal, the attacker loses the easiest asset to phish, replay or sell. The practical signal for programme owners is that authentication design now has to be measured by how little identity material remains available to harvest.

Access reviews alone do not stop harvested credentials from being used. Reviews tell you who should have access on paper, but credential theft turns a valid entitlement into an active compromise between review cycles. That is why identity telemetry and rapid session revocation have to sit alongside governance processes.

For practitioners

• Implement phishing-resistant authentication Replace reusable passwords for high-value access paths with phishing-resistant methods such as FIDO2 or hardware-backed factors, and remove fallback paths that still accept weaker secrets.
• Eliminate shared credential reuse Assign unique credentials per person and per system where possible, then remove shared logins that prevent you from telling who actually performed an action.
• Monitor for credential exposure and token replay Watch for leaked credentials, abnormal login geography, repeated failures across accounts, and session use from unfamiliar devices or IP ranges, then revoke sessions quickly when exposure is confirmed.
• Shift detection to identity-layer telemetry Use identity provider logs, reset events and session history to spot compromised access, because device-level monitoring alone will miss abuse in shared-terminal environments.

Key takeaways

• Credential harvesting works because attackers can convert stolen login material into apparently legitimate access, which bypasses many perimeter-oriented defenses.
• Shared-device workflows make this worse because a single terminal can hide unauthorized use inside normal shift activity.
• Reducing the attack surface requires stronger authentication, less credential reuse and better identity-layer telemetry, not just more user awareness.

Related NHI Mgmt Group resources: Workforce Identity Security Guide · API Key Management Guide · Password Security and Password Manager Guide · Ultimate Guide to NHIs: Static vs Dynamic Secrets

Key terms

• Credential Harvesting: Credential harvesting is the collection of secrets, tokens, keys, or certificates from a compromised workload. In container environments, it often targets file paths, environment variables, service account tokens, and metadata services because those locations frequently hold reusable identity material.
• Credential Stuffing: Credential stuffing is an attack that uses stolen username and password pairs from previous breaches to try logging into other services. It works because many people reuse credentials, and because the login attempt uses valid information, it can look ordinary until the surrounding behavior gives it away.
• Adversary-in-the-middle Attack: An adversary-in-the-middle attack intercepts and relays authentication in real time between the user and the legitimate service. It is especially dangerous for OTPs because the attacker can capture the code while it is still valid and immediately use it to complete login.
• Passwordless Authentication: An authentication approach that removes passwords and uses a device-bound cryptographic key plus local user verification. It reduces phishing and replay risk, but it only improves assurance when enrollment, recovery, and revocation are tightly governed.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.