Topic starter
02/01/2026 11:32 am
TL;DR: Credential phishing rose 703% in the second half of 2024, far outpacing overall email-based phishing growth, while AI-driven lures, multi-channel delivery, and precision validation are making credential theft easier to scale, according to RSA Security. Passwordless authentication, phishing-resistant MFA, and tighter identity controls now matter because stolen credentials remain the fastest path from social engineering to account takeover.
Editorial analysis by NHI Mgmt Group, based on content published by RSA Security: “Credential Phishing: What It Is and How to Prevent It”.
By the numbers:
- Credential phishing increased 703% in the second half of 2024.
- Overall email-based phishing threats increased 202% in the second half of 2024.
- Phishing cost an average of $4.88 million per breach, according to IBM Cost of a Data Breach Report cited by RSA Security.
Key questions
Q: What breaks when organisations rely on password resets after a phishing compromise?
A: A password reset changes the credential, but it does not necessarily terminate live sessions or invalidate refresh tokens already issued to the attacker.
A: Credential theft and phishing remain effective because many MFA deployments still rely on factors that attackers can intercept, reuse, or socially engineer around.
Q: How do security teams know whether passwordless controls are actually reducing phishing risk?
A: Look for fewer successful replay attempts, fewer account takeovers after suspicious messages, and a lower volume of credential stuffing against the same users.
Practitioner guidance
- Replace reusable passwords for high-value applications Prioritise passwordless authentication or passkeys where account takeover risk is highest, especially for email, admin portals, and applications that can unlock downstream systems.
- Adopt phishing-resistant MFA for privileged and high-risk users Use hardware-backed or otherwise phishing-resistant factors for administrators, finance users, and any role that can access sensitive business systems or reset credentials.
- Reduce the number of login entry points Consolidate authentication through a central identity provider so users authenticate once under stronger controls instead of facing many separate logins that attackers can target independently.
Bottom line: Credential phishing remains one of the most scalable entry points for account takeover because it captures usable identities rather than just deceptive clicks.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/10/2026 4:25 am
Credential phishing is now an identity control failure, not only a user-awareness failure. The article shows that the attack succeeds because organisations still depend on reusable secrets and phishable second factors at the point of authentication. Once those values can be captured, the attacker inherits the identity path rather than breaking into it. The practitioner conclusion is that IAM design, not just training, determines whether phishing becomes account takeover.
A few things that frame the scale:
- The IBM/Ponemon 2025 Cost of a Data Breach Report found that phishing-initiated breaches cost an average of $4.8M each.
A question worth separating out:
A: Security teams should treat cross-channel phishing as a unified threat, not an email-only problem. Defenses need semantic analysis, reputation checks, and click-time URL inspection across email, SMS, messaging, and collaboration tools. User education matters too, because attackers often try to move conversations into less monitored channels where victims are more likely to comply with requests.
👉 Read our full editorial: Credential phishing is forcing passwordless and phishing-resistant MFA