Hidden authentication exposes the limits of password vault governance

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Unixi's blog post: Password vault governance fails against AiTM phishing, and hidden authentication changes the control model.

Why it matters: IAM and security teams should treat copyable secrets as a design flaw, because vaulting alone does not prevent session theft or user-mediated credential handoff.

Context

Password vaults store credentials securely, but they do not stop a user from copying a secret into a malicious login page or surrendering a session token to an adversary-in-the-middle proxy. That gap matters because the control failure is not storage, it is the exposure of human-readable authentication material during use.

For identity programmes, this is a governance problem as much as a technology problem. When a control still depends on a person seeing, copying, or typing a secret, phishing resistance is incomplete and the authentication model remains vulnerable to social engineering and token theft.

Key questions

Q: What breaks when users can still copy credentials from a password vault?

A: The control breaks at the point of use, not at rest. If a user can see and paste a secret into a fake login page, the vault has protected storage but not authentication. AiTM phishing exploits exactly that gap, so the real test is whether the credential can be transferred into a malicious flow at all.

Q: Why do vaults and MFA still fail against adversary-in-the-middle phishing?

A: Because the attacker does not need to crack the vault or guess the password. They only need to relay the login flow in real time, capture the authenticated session, and reuse it. If the second factor can be proxied, the control is vulnerable even when the user followed the expected steps.

Q: How should security teams phase out copyable secrets without breaking access?

A: Start with the applications and user groups most exposed to phishing and session theft, then replace password-based sign-in with methods that do not expose a transferable secret. Keep the migration focused on high-risk access paths first, because those are the sessions most likely to be harvested by proxy attacks.

Q: What is the difference between secret vaulting and phishing-resistant authentication?

A: Secret vaulting protects how credentials are stored. Phishing-resistant authentication protects how access is proven. A vault can keep a password safe until a user reveals it, but a phishing-resistant method removes the useful secret from the user-facing flow, so there is nothing to copy into a fake page.

Technical breakdown

Why password vaults do not stop AiTM phishing

A password vault protects secrets at rest, not during interactive use. In an adversary-in-the-middle attack, the attacker proxies the legitimate login page and captures what the user submits in real time. If the user can copy a password from the vault and paste it into the proxy, the vault has already lost the security battle at the point of use. The same problem applies to session tokens when MFA is intercepted after authentication. This is why the issue is not credential strength alone, but whether the credential ever becomes transferable to a malicious endpoint.

Practical implication: move phishing resistance into the authentication method itself, not just into password storage.

Hidden authentication and domain-bound cryptography

Hidden authentication removes the human-readable secret from the login path. Instead of a typed password, the browser or device completes a cryptographic challenge that is bound to the legitimate domain and cannot be replayed against a lookalike site. That changes the attack surface from secret theft to proof-of-possession, which is materially harder to manipulate through a proxy. The key governance point is that the user never sees the private material, so there is nothing to paste, disclose, or reuse in a fake prompt.

Practical implication: prefer authentication flows where the user cannot reveal the underlying secret even under phishing pressure.

Why MFA can still fail when the session is intercepted

MFA improves assurance only if the attacker cannot relay the authenticated session in real time. AiTM kits defeat that assumption by capturing the browser session after the user completes the second factor, then forwarding the resulting token to the attacker. In other words, the second factor may be present, but the session still becomes portable. This is why legacy MFA, especially methods vulnerable to real-time relay, does not fully close the gap left by copyable passwords and user-mediated token exposure.

Practical implication: evaluate whether your MFA method resists real-time relay, not just whether MFA is enabled.

Threat narrative

Attacker objective: The attacker wants a valid authenticated session that can bypass the password vault and MFA controls without triggering obvious suspicion.

1. Entry occurs when the user clicks a convincing phishing link that opens a proxy login page mirroring the legitimate identity provider.
2. Credential access follows when the user copies a vaulted password into the fake page and the attacker relays the MFA flow or session token in real time.
3. Impact occurs when the attacker reuses the captured session to access authorized applications without needing the original user’s secret again.

Breaches seen in the wild

• Ledger Connect Kit npm compromise 2023: Attackers phished a former Ledger employee with unrevoked npm access and published a wallet-draining Connect Kit, stealing about $600k on 14 Dec 2023.
• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Hidden authentication is a control model, not a cosmetic replacement for passwords: the core issue is that vaults still depend on human-readable secrets entering a browser session. Once a credential can be copied, typed, or relayed, it remains exposed to phishing mediation. The implication is that identity programmes must judge controls by transferability at use time, not by how well they store secrets at rest.

AiTM phishing exposes the limits of vault governance: the governance assumption behind password managers is that protecting storage materially protects authentication. That assumption fails when the attacker intercepts the authentication flow rather than the vault itself. The implication is that access assurance has to move from secret custody to phishing-resistant authentication design.

Session theft is the real failure mode, not password complexity: the article shows that a 20-character vault-stored password can still become breach fuel when it is pasted into a proxy page. That makes complexity and rotation secondary to whether the login method can be relayed. Practitioners should treat token portability as the security variable that matters.

Human-mediated authentication is now the weakest link in otherwise mature programmes: even well-trained employees can be manipulated into handing over secrets through a believable login flow. That is a behavioural constraint, not an awareness-training issue. The implication is that governance must assume users will be tricked and design authentication so the trick fails.

Phishing resistance should be evaluated as an end-to-end property: a control is not resistant if the secret or session can be recovered after the second factor succeeds. Hidden authentication changes the trust boundary by removing the observable secret entirely, which is the right direction for modern IAM and NHI-adjacent access models. Practitioners should test the whole login path, not individual control checkpoints.

From our research library:

• 73% of vaults are misconfigured, leading to unauthorised access and exposure of sensitive data, according to the Ultimate Guide to NHIs.
• Only 44% of organisations are currently using a dedicated secrets management system, according to the 2024 State of Secrets Management Survey.
• Read next: Passwordless and Passkeys Guide

What this signals

Credential transferability is the hidden control boundary: programmes that still allow a person to copy, paste, or relay a secret are treating storage as the problem when the real issue is use-time exposure. That boundary matters more than password length, because attackers now target the moment of disclosure rather than the vault itself.

Phishing resistance has to be designed into the authenticator: if the secret or token can survive a spoofed browser session, the control is not finished. Security teams should expect hidden-authentication methods to replace reliance on human behaviour, because human training cannot reliably defeat real-time proxy attacks.

For practitioners

• Replace copyable secrets with phishing-resistant login flows Prioritise authentication methods that do not expose a password, OTP, or session token to the user during sign-in. The goal is to remove transferable material from the browser path so a proxy page cannot capture it.
• Review where session tokens can be relayed Map authentication methods that still allow real-time proxying, especially legacy MFA and browser-based flows that hand back usable tokens after sign-in.
• Treat vaults as storage control, not assurance control Keep password vaults only as a transitional safeguard where needed, but do not count them as protection against AiTM phishing or user-mediated secret disclosure.
• Identify shadow SaaS that still depends on passwords Focus remediation on legacy applications and unmanaged SaaS where copied credentials remain part of the login path, because those are the easiest targets for hidden-authentication replacement.

Key takeaways

• Password vaults reduce exposure at rest, but they do not stop a user from handing a secret to an attacker inside a fake login flow.
• AiTM phishing succeeds by relaying real authentication steps, which means MFA and vaulting can both be present while the session is still compromised.
• Hidden authentication changes the game by removing transferable secrets from the user-facing path, so the login method itself becomes resistant to proxy-based theft.

Key terms

• Adversary-in-the-middle phishing: A phishing method that places an attacker between the user and the real identity provider so the attacker can intercept or relay the authenticated session. It often preserves the user experience, which is why it can evade awareness and some detection paths while still producing usable session tokens.
• Hidden authentication: A login model where the user does not directly see or type the reusable secret that grants access. The control reduces disclosure risk by moving authentication material out of human reach and into cryptographic or device-bound verification, which changes the security model from copyable secret to non-transferable proof.
• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
• Real-Time Token Relay: A phishing technique where an attacker captures a one-time code or similar factor and forwards it immediately to the legitimate service before the session expires. The problem is not only theft but timing, because the code remains usable long enough to complete authentication in the attacker’s hands.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.