Credential phishing is forcing passwordless and phishing-resistant MFA

At a glance

What this is: This RSA Security article explains how credential phishing has evolved into a high-scale credential theft problem and why passwordless authentication plus phishing-resistant MFA are the main controls now under pressure.

Why it matters: It matters because IAM teams still see passwords and weak second factors as the easiest attack path into business systems, so reducing credential replay and phishing success directly changes account takeover risk.

By the numbers:

• Credential phishing increased 703% in the second half of 2024.
• Overall email-based phishing threats increased 202% in the second half of 2024.
• Phishing cost an average of $4.88 million per breach, according to IBM Cost of a Data Breach Report cited by RSA Security.
• Phishing breaches took an average of 261 days to contain, according to IBM Cost of a Data Breach Report cited by RSA Security.

Context

Credential phishing is a credential-theft attack that tricks people into handing over usernames, passwords, or other login factors so an attacker can access email, business systems, or cloud services. In identity programmes, it matters because the attack succeeds by abusing trust in login flows rather than by breaking the underlying platform.

RSA Security frames the problem as a scale-and-sophistication shift: AI-generated lures, multi-channel delivery across email, SMS, social platforms, and collaboration tools, and real-time validation are making phishing more efficient. That changes the governance problem for human IAM and the downstream NHI and application access that often follow a compromised user account.

The article also shows why credential theft stays attractive to attackers: once a login works, it can support lateral movement, credential stuffing, password spraying, or further phishing from the compromised account. That makes credential phishing a front-door issue for identity security rather than a narrow awareness-training problem.

Key questions

Q: What breaks when organisations rely on password resets after a phishing compromise?

A: A password reset changes the credential, but it does not necessarily terminate live sessions or invalidate refresh tokens already issued to the attacker. If those artefacts remain active, the compromise continues even though the password has changed. Incident response has to include explicit session revocation.

Q: Why do credential theft and phishing remain so effective even in organisations using multi-factor authentication?

A: Credential theft and phishing remain effective because many MFA deployments still rely on factors that attackers can intercept, reuse, or socially engineer around. Once credentials are exposed, attackers often move to the other factors rather than stop. The result is a repeated cycle of compromise and detection, especially when organisations treat authentication as a recovery problem instead of a prevention problem.

Q: How do security teams know whether passwordless controls are actually reducing phishing risk?

A: Look for fewer successful replay attempts, fewer account takeovers after suspicious messages, and a lower volume of credential stuffing against the same users. If stolen credentials still authenticate elsewhere, the control is not yet reducing the attacker's usable path.

Q: How should security teams defend against phishing that starts in email and pivots into SMS or collaboration apps?

A: Security teams should treat cross-channel phishing as a unified threat, not an email-only problem. Defenses need semantic analysis, reputation checks, and click-time URL inspection across email, SMS, messaging, and collaboration tools. User education matters too, because attackers often try to move conversations into less monitored channels where victims are more likely to comply with requests.

Technical breakdown

How AI-driven credential phishing increases hit rates

Modern credential phishing no longer depends on clumsy mass emails. Attackers can generate polished, context-aware messages that imitate internal departments, vendors, or services and push a user toward a fake login page or malicious prompt. The technical shift is not just better wording. It is better timing, better targeting, and more believable delivery across email, SMS, collaboration platforms, and voice channels. That raises the success rate because the message fits the user's normal work patterns and the fake page is often tailored to the target environment. Practical implication: treat phishing as an adaptive identity attack surface, not just a spam-filter problem.

Practical implication: Shift detection and user verification controls toward channel-agnostic phishing resistance and real-time account protection.

Why fake login pages defeat password-based and weak MFA flows

Fake login pages work because they intercept credentials at the point of entry and forward them to the attacker in real time. If the authentication flow still depends on a reusable secret, the attacker can replay that secret immediately or use it in follow-on attacks such as password stuffing. Even when an organisation has MFA, phishable second factors can still be captured or proxied. Passwordless methods and phishing-resistant MFA reduce the value of the fake page because there is no password to harvest and no weak factor to relay. Practical implication: assess whether your login flow can be completed on a spoofed domain before you assume MFA is doing its job.

Practical implication: Replace reusable secrets and phishable second factors with authentication methods that cannot be replayed from a fraudulent site.

How credential theft turns into lateral movement and account takeover

Once a stolen credential is valid, the attacker is no longer limited to the original phishing campaign. The article describes credential stuffing, password spraying, and reuse across services as the follow-on mechanisms that turn a single captured login into broader access. That is why credential phishing often becomes an entry point for email compromise, data exfiltration, further social engineering, or malware delivery from a trusted account. In identity terms, the compromise of one authenticated session can expand into multiple systems when reuse and poor lifecycle governance remain in place. Practical implication: build controls that assume stolen credentials will be tried everywhere they can work.

Practical implication: Correlate stolen-login signals with reuse risk, anomalous sign-ins, and privileged follow-on access paths.

Threat narrative

Attacker objective: The attacker wants a valid login that can be reused for account takeover and broader access across business systems.

1. Entry occurs when the attacker sends a deceptive message through email, SMS, collaboration tools, or voice and lures the user to a fake login page.
2. Credential harvesting happens when the user enters credentials on the spoofed page and the attacker captures the values in real time.
3. Escalation follows when the attacker reuses the stolen login through credential stuffing or password spraying against other services and identities.
4. Impact is account takeover, lateral movement, data exfiltration, and further phishing from the compromised account.

Breaches seen in the wild

• Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.
• Taiwan autonomous AI agent cyberattack 2026: Up to eight autonomous AI agents cracked 85 Taiwanese government accounts, pivoted through SSO and exfiltrated 2,564+ personnel records.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Credential phishing is now an identity control failure, not only a user-awareness failure. The article shows that the attack succeeds because organisations still depend on reusable secrets and phishable second factors at the point of authentication. Once those values can be captured, the attacker inherits the identity path rather than breaking into it. The practitioner conclusion is that IAM design, not just training, determines whether phishing becomes account takeover.

Phishing-resistant controls are becoming the boundary between authentication and credential replay. Passwordless methods and phishing-resistant MFA do more than improve user experience. They remove or harden the credential artifact that fake pages are trying to steal. That matters because the article's attack chain depends on the same secret being usable outside the original login context. The practitioner conclusion is to judge controls by replay resistance, not by factor count.

Multi-channel phishing expands the attack surface beyond email hygiene. When attackers can use SMS, collaboration platforms, social media, and voice, the defensive model has to follow the user across channels rather than stopping at the inbox. That shifts the problem from mail security to identity assurance, because the lure can arrive anywhere the identity is reachable. The practitioner conclusion is that channel-specific controls must be tied to a single identity risk model.

High-volume credential theft exposes an identity blast radius problem. The named concept here is identity blast radius, the number of systems that become reachable after one credential is stolen. Credential stuffing and password spraying turn one successful phish into a wider compromise path because reuse still exists across services. The practitioner conclusion is to reduce how far one stolen login can travel through the estate.

Zero Trust only helps if authentication is genuinely non-replayable. The article's control set aligns with Zero Trust assumptions, but only when verification is continuous and credentials cannot be easily lifted and reused elsewhere. Otherwise, a phished login simply becomes another trusted session. The practitioner conclusion is to align access design, session monitoring, and phishing resistance as one identity programme rather than separate initiatives.

From our research library:

• The IBM/Ponemon 2025 Cost of a Data Breach Report found that phishing-initiated breaches cost an average of $4.8M each.

What this signals

Identity teams should treat credential phishing as a session-entry problem that crosses channels. The attack no longer begins and ends in email, which means the control set has to follow the user into SMS, collaboration platforms, and voice-based lures. Passwordless controls matter most when they remove the reusable secret that these lures are trying to harvest.

Identity blast radius is the concept that now deserves more attention. Once a credential is stolen, the practical question is how many systems that login can still reach and how quickly follow-on access can spread. Programmes that have not reduced reuse, consolidated authentication, and tightened privileged access will keep turning one phish into several incidents.

Phishing resistance must be measured by replay resistance, not by factor count. A control can still look like MFA and fail the real test if a fake login page can capture or proxy it. That distinction matters for human IAM and for the non-human access that often inherits trust after a user account is compromised.

For practitioners

• Replace reusable passwords for high-value applications Prioritise passwordless authentication or passkeys where account takeover risk is highest, especially for email, admin portals, and applications that can unlock downstream systems.
• Adopt phishing-resistant MFA for privileged and high-risk users Use hardware-backed or otherwise phishing-resistant factors for administrators, finance users, and any role that can access sensitive business systems or reset credentials.
• Reduce the number of login entry points Consolidate authentication through a central identity provider so users authenticate once under stronger controls instead of facing many separate logins that attackers can target independently.
• Harden detection for multi-channel phishing Extend monitoring beyond email to SMS, collaboration tools, and voice-based social engineering so credential theft attempts are visible across the channels users actually use.
• Assume stolen credentials will be reused Correlate suspicious logins with credential stuffing, password spraying, and anomalous access to other services so one phish does not become a wider compromise.

Key takeaways

• Credential phishing remains one of the most scalable entry points for account takeover because it captures usable identities rather than just deceptive clicks.
• The article's evidence shows the problem is growing faster than generic phishing, which raises the value of replay-resistant authentication and tighter identity governance.
• Security teams should prioritise passwordless authentication, phishing-resistant MFA, and broader channel coverage because stolen credentials still drive the downstream compromise chain.

Key terms

• Credential Phishing: Credential phishing is a social engineering attack that tricks a person into handing over login secrets such as passwords or passcodes. In identity programmes, it matters because the stolen secret can be reused to impersonate the user, access applications, and bypass ordinary authentication controls.
• Passwordless Authentication: An authentication approach that removes passwords and uses a device-bound cryptographic key plus local user verification. It reduces phishing and replay risk, but it only improves assurance when enrollment, recovery, and revocation are tightly governed.
• Phishing-Resistant MFA: Phishing-resistant MFA uses authentication factors that cannot be easily replayed, intercepted, or socially engineered. In regulated environments, this usually means device-bound or cryptographic methods rather than push prompts or SMS codes, because the control must hold up under realistic attack conditions.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.