They treat antivirus as a final control rather than one signal among several. When malware is wrapped in a legitimate-looking installer and obfuscated, signature-based tools may miss it entirely. Behavioural monitoring, DNS filtering, and download provenance checks are needed to catch the full attack chain.
Why This Matters for Security Teams
Credential-stealing campaigns rarely succeed because antivirus is absent. They succeed because defenders mistake malware detection for complete prevention. In practice, attackers often distribute loaders, fake installers, and living-off-the-land activity that looks benign to signature-based tools. That creates a gap between what endpoint protection can reasonably detect and what the business assumes it will stop. NIST’s NIST SP 800-53 Rev 5 Security and Privacy Controls makes clear that control coverage must span detection, logging, and response, not a single product outcome.
The operational mistake is treating antivirus as the security decision point for identity theft, rather than one sensor in a wider chain that includes browser telemetry, DNS inspection, identity protection, and cloud log correlation. When malware is used to steal session tokens, browser cookies, or saved credentials, the damage often happens after initial execution, not at the point of file write. That means the real control objective is to reduce trust in the endpoint and increase confidence in downstream detection. In practice, many security teams encounter credential theft only after a valid account is already being used from a new location, rather than through intentional malware detection.
How It Works in Practice
A more effective approach is to think in stages: delivery, execution, credential access, and abuse. Antivirus may catch some payloads at delivery or execution, but credential-stealing campaigns frequently use packaging that evades static signatures, then pivot into browser data theft, token harvesting, or credential dumping. That is why event correlation matters as much as prevention. Security teams should pair endpoint coverage with DNS filtering, download reputation, browser hardening, and identity telemetry from authentication systems.
For identity-centric environments, the issue extends beyond the workstation. If a stolen token can be replayed into SaaS, VPN, or admin consoles, endpoint alerts alone are too late. The NIST SP 800-63 Digital Identity Guidelines reinforce the value of authentication strength, session management, and binding identity proofing to controlled access flows. In parallel, the OWASP Non-Human Identity Top 10 is a useful reminder that token theft does not stop at human accounts; service credentials, API keys, and automation tokens are also prime targets when they are stored or reused insecurely.
- Use antivirus as one detection layer, not the final approval gate for execution.
- Block risky downloads and inspect provenance, especially for unsigned or newly observed installers.
- Correlate EDR alerts with DNS, proxy, authentication, and privilege escalation events.
- Harden browsers and protect stored secrets, saved passwords, and session artifacts.
- Watch for post-execution behaviours such as token export, unusual browser access, and outbound credential exfiltration.
Security teams also need to decide what counts as success. A clean antivirus scan does not mean the system is trustworthy if the user has just approved a malicious installer, synced a stolen session token, or authenticated from an unusual device. These controls tend to break down in heavily remote, browser-centric environments because trust shifts from the file to the session, and the session is where traditional antivirus has the least visibility.
Common Variations and Edge Cases
Tighter endpoint control often increases operational friction, requiring organisations to balance malware resistance against software delivery speed and user support overhead. That tradeoff is especially visible when legitimate installers are repackaged by third parties, when employees use unmanaged devices, or when SaaS access happens entirely in the browser. In those cases, a clean endpoint may still be a compromised identity path.
Best practice is evolving for cloud-hosted and hybrid environments where the endpoint is not the only place secrets live. Current guidance suggests focusing on download provenance, execution policy, and identity-based detection rather than expecting antivirus to recognise every malicious binary. Where agentic workflows or automation scripts use service credentials, the same logic applies: stolen secrets can be abused without any obvious malware persistence. The practical response is layered validation, stronger session controls, and logging that can show whether an apparent user action was actually a compromised identity event.
For teams building policy, this is less about replacing antivirus and more about narrowing what it is trusted to do. A good question is not whether the file was blocked, but whether the organisation would still detect the theft if the file ran once and disappeared. That is the gap that usually matters most in credential-stealing campaigns.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-63, NIST AI RMF and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | DE.CM-1 | Continuous monitoring is needed when AV misses staged credential theft. |
| NIST SP 800-63 | AAL2 | Strong authentication helps limit reuse of stolen credentials and tokens. |
| NIST AI RMF | The risk management approach fits layered detection and trust decisions for endpoints. | |
| OWASP Non-Human Identity Top 10 | Credential-stealing campaigns often target service tokens and automation secrets too. | |
| NIST SP 800-53 Rev 5 | SI-3 | Malicious code protection is only one part of broader detection and response. |
Use AI RMF-style governance thinking to define where endpoint trust ends and identity risk begins.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
