Google and Apple credential leak exposes the limits of password security

At a glance

What this is: A large credential leak exposed plaintext logins, tokens and metadata across major consumer and enterprise services, showing how password-based identity controls break down at scale.

Why it matters: IAM teams must treat unmanaged SaaS, infostealer exposure and session hijack risk as a programme issue, not just an authentication issue, because the blast radius spans human and machine access paths.

👉 Read Unixi's analysis of the Google and Apple credential leak

Context

A credential leak of this kind is an identity governance failure, not just a data exposure event. When passwords, session cookies and metadata are harvested from endpoints and then staged in an unsecured repository, the problem extends to authentication, session integrity and unmanaged application access across the SaaS estate.

For identity teams, the key issue is coverage. Even strong SSO on core systems does not protect browser-based applications that sit outside the identity provider, and those gaps become a shadow access layer that attackers can exploit through stolen credentials and session artefacts.

Key questions

Q: How should security teams reduce account takeover risk when passwords are exposed in infostealer data?

A: Teams should assume the password is already lost and focus on revoking sessions, invalidating tokens, and re-establishing trust at the device and identity layer. Password resets help only if session artefacts and browser-stored credentials are also removed from circulation. The control objective is to prevent replay, not just to change the secret.

Q: Why do unmanaged SaaS apps create access risk even when SSO is in place?

A: Because SSO only governs the apps it covers. Employees can still use browser tools, local accounts, and OAuth-linked services outside federation, which leaves access invisible to standard identity reporting. The risk is not the absence of authentication, but the absence of complete lifecycle control over what users can actually reach.

Q: What breaks when session tokens are stored insecurely?

A: If tokens are readable by browser scripts or are not rotated and revoked correctly, a single XSS issue or stolen token can preserve attacker access after login. Secure session design requires short-lived access tokens, protected storage, regeneration on authentication, and working revocation across logout and account changes.

Q: What should organisations do first when infostealer activity is suspected on user endpoints?

A: Contain the endpoint, invalidate active sessions, rotate affected credentials and review which unmanaged apps may still trust the stolen artefacts. The priority is to break replayability before the attacker can use harvested identity material across multiple services. Containment must happen across both device and identity planes.

Technical breakdown

Why plaintext credentials create a reusable identity failure

Plaintext usernames and passwords are immediately actionable because they do not require cracking, replay-resistant proof or additional transformation. Once an infostealer extracts them, the attacker can test them against consumer portals, enterprise apps and federated services at scale. Session cookies and tokens increase the problem because they can bypass password checks and, in some cases, step around MFA if the session is still valid. This is why credential exposure is not just an authentication event. It is a reuse event that turns one compromised endpoint into many possible account takeovers.

Practical implication: reduce the lifetime and reusability of credentials and session artefacts rather than relying on password strength alone.

Why shadow SaaS defeats centralised identity controls

Shadow SaaS exists when users authenticate to browser-based tools that do not integrate cleanly with SAML, SCIM or an identity provider's policy stack. Some apps store credentials locally, some rely on ad hoc logins, and many bypass lifecycle controls that IAM teams assume are universal. That creates a fragmented identity plane where access review, deprovisioning and MFA enforcement are inconsistent. The operational risk is not only that one account is compromised. It is that nobody has full visibility into where the account exists or how it is authenticated.

Practical implication: inventory browser-based applications and classify which ones sit outside SSO, lifecycle and MFA enforcement.

Why infostealer malware changes the authentication threat model

Infostealer malware captures browser-saved passwords, cookies, tokens and sometimes autofill data before sending it to attacker-controlled infrastructure. That means compromise can begin on the endpoint but quickly become an identity event across cloud apps, portals and SaaS tools. Traditional perimeter thinking misses this because the theft happens before any login failure, alert or brute-force threshold is crossed. In practice, the identity system is consuming already-compromised artefacts. Once those artefacts are replayed, the attacker is operating inside legitimate-looking sessions rather than forcing entry.

Practical implication: pair endpoint controls with identity telemetry so stolen session material is treated as an identity compromise, not only an endpoint issue.

Threat narrative

Attacker objective: The objective is broad account takeover and downstream access to personal, enterprise and regulated services using reusable credentials and session artefacts.

1. Entry via infostealer malware on user devices harvested saved credentials, session cookies and metadata before uploading them to attacker infrastructure.
2. Credential access occurred when plaintext usernames and passwords were staged in an unsecured ElasticSearch server with no encryption or access control.
3. Impact followed through reusable credentials that could be tested across consumer, enterprise and regulated accounts in multiple countries.

Breaches seen in the wild

• Salesloft OAuth token breach — hackers stole OAuth tokens to access Salesforce data via Salesloft.
• GitHub Dependabot Breach — GitHub Dependabot tokens stolen and abused to push malicious commits to repositories.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Password exposure is now an identity reuse problem, not a password policy problem. When plaintext credentials, cookies and metadata are exposed together, attackers are no longer solving authentication, they are replaying identity. That collapses the assumption that password complexity or rotation alone meaningfully reduces risk. The practitioner conclusion is that identity assurance must account for the artefacts that survive login, not just the password itself.

Shadow SaaS is the governance gap that turns SSO into an incomplete control. Centralised identity works only where applications are onboarded into the policy plane, and browser-based tools often are not. That means deprovisioning, MFA enforcement and access reviews can all be technically sound while still missing a large part of the actual SaaS estate. The practitioner conclusion is that coverage, not policy intent, is the control measure that matters.

Session artefacts are the new high-value credentials. Session cookies and tokens can bypass the very controls teams rely on after password theft is detected. In NIST CSF terms, this is a protection and detection alignment problem, but in operational terms it means the identity boundary extends beyond password reset. The practitioner conclusion is that session governance must be treated as part of IAM, not as a separate browser issue.

Identity first security becomes credible only when unmanaged access paths are brought into scope. The breach is a reminder that human IAM, SaaS governance and endpoint compromise are one chain, not three separate problems. That makes the programme question less about replacing passwords in a single app and more about whether the identity team can see and govern the full access surface. The practitioner conclusion is that partial coverage creates false confidence.

From our research:

• 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to The 2024 ESG Report: Managing Non-Human Identities.
• A separate finding in the same report shows that enterprises that have experienced a compromised NHI averaged 2.7 separate incidents in the past 12 months.
• For a broader view of credential exposure patterns, see 52 NHI Breaches Analysis for recurring root causes and breach mechanics.

What this signals

Passwordless still fails if the identity surface is incomplete: the issue is not whether a single app supports modern authentication, but whether every browser-based access path is inside governance. In practice, teams need a complete inventory of unmanaged SaaS, because hidden login surfaces create the same control blind spots that passwords were supposed to remove.

With 72% of organisations having experienced or suspecting an NHI breach in our research, identity teams should expect more overlap between endpoint compromise, credential theft and cloud account takeover. The practical signal is that governance programmes need shared ownership across IAM, endpoint security and SaaS onboarding, not isolated fixes in each domain.

The next governance step is to treat browser-stored secrets, session artefacts and local logins as part of the identity lifecycle. That changes recertification, incident response and access review workflows because the object being governed is no longer only the account, but the full set of reusable access artefacts tied to it.

For practitioners

• Inventory unmanaged browser-based applications Map every SaaS application that accepts local login, stored credentials or non-federated access, then classify whether it sits outside SSO, SCIM and MFA policy enforcement. Prioritise the apps with real data access and no lifecycle ownership.
• Treat session cookies as credentials Extend incident response to include token and cookie invalidation when infostealer exposure is suspected. A password reset alone is insufficient if the active session remains valid or can be replayed from a captured browser profile.
• Combine endpoint and identity telemetry Correlate infostealer detections, suspicious login geography and impossible session reuse so the identity team can identify which accounts may already be compromised before normal sign-in failures appear.
• Enforce phishing-resistant authentication on exposed services Use FIDO2 or WebAuthn where supported, but do not treat MFA as complete coverage if unmanaged SaaS still relies on stored credentials or local browser authentication.

Key takeaways

• Large credential leaks are identity failures because stolen passwords, cookies and tokens can be replayed across many services, including regulated ones.
• The scale of unmanaged SaaS access matters as much as the breach itself because centralised SSO does not govern every browser-based application.
• Identity teams need to manage sessions, endpoints and application coverage together, or password resets will keep arriving after the attacker already has usable access.

Key terms

• Shadow SaaS: Shadow SaaS is the set of unauthorised or unreviewed software-as-a-service tools used outside central security governance. These applications often bypass normal identity controls, making them difficult to inventory, monitor, and harden against credential-based abuse.
• Session artefacts: Temporary access material such as active login sessions, cookies, tokens, and cached credentials that prove trust without requiring the original password again. These artefacts are often the shortest path from endpoint compromise to cloud or SaaS account abuse.
• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
• Identity Replay Exposure: Identity replay exposure is the period during which a stolen credential remains valid and usable across one or more systems. It is a governance problem, not just a detection problem, because the risk persists until the secret is revoked, rotated, or otherwise rendered unusable.

What's in the full article

Unixi's full article covers the operational detail this post intentionally leaves for the source:

• The full breach narrative and the exact credential mix found in the exposed dataset.
• The vendor's breakdown of why shadow SaaS bypasses standard identity provider controls.
• Practical recommendations for passwordless rollout, endpoint hardening and phishing-resistant MFA.
• The article's explanation of how Universal SSO is positioned against unmanaged browser-based access.

👉 Unixi's full post covers the breach scope, shadow SaaS risk and remediation angle.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.