Because they let an attacker borrow the appearance of legitimate delivery and use it to harvest credentials, tokens, or execution rights. That turns a web trust issue into an identity issue when the site is used to trigger login-like behaviour, session theft, or malware installation. Security teams need to treat delivery trust as part of access governance.
Why compromised delivery channels raise identity risk
Compromised websites and malvertising matter because they let an attacker borrow trust that users and security tools already extend to a legitimate brand, domain, or ad path. That trust can be converted into credential capture, token theft, session hijack, or forced execution of code that changes who or what is authenticated. The result is not just web compromise, but an identity compromise path.
In practice, the risk comes from the handoff between delivery and access. A malicious page, ad, redirect, or injected script can present a convincing login flow, prompt reauthentication, or silently trigger actions that abuse an existing session. When the delivery layer is abused this way, the security team has to treat it as an access problem, not only a content or web filtering problem.
Compromised delivery also broadens the blast radius. A single malicious campaign can target employees, contractors, administrators, and automated browsers or agents differently, depending on which identities they can reach and which tokens they hold. That is why delivery trust and identity governance need to be reviewed together rather than in separate silos.
What attackers are actually trying to steal
The attacker goal is usually one of three things: harvest credentials, steal session material, or gain a foothold for follow-on execution. Credential theft is the most obvious path, but modern campaigns often prefer session cookies, OAuth tokens, API keys, or password-reset flows because those can bypass stronger passwords and sometimes bypass MFA entirely. A compromised site or ad can be the delivery mechanism that makes that theft feel routine.
This is why the content of the page matters less than the authority the page appears to have. If the attacker can make the victim believe the flow is legitimate, the victim may enter secrets, approve a prompt, or reauthenticate into a fake session. That turns a web trust issue into a direct identity risk, especially when privileged users or high-value service accounts are in scope.
Security teams should also watch for post-compromise chaining. Once one credential or token is captured, the attacker may pivot into email, cloud consoles, SaaS admin panels, or internal tools. Compromised delivery is often only the first step in a broader identity attack chain, not the final objective.
Why this changes the control model for security teams
Delivery trust has to be governed alongside access trust. If users can be steered into entering credentials on lookalike pages, or if browser sessions can be hijacked through injected content, then controls focused only on perimeter web security will miss the identity impact. The practical answer is to combine safe browsing, phishing-resistant authentication, session protection, token hygiene, and rapid revocation paths.
This is where the strongest internal guidance helps. NHIMG’s Identity Security Programme Guide is useful because the issue spans governance, ownership, and operating model, not just one control. For teams dealing with login flows and token abuse, the NHI Lifecycle Management Guide is also relevant where machine or application credentials are exposed through malicious delivery paths. The broader Ultimate Guide to NHIs gives the parent model for how credentials, tokens, and service access fit into the same trust chain.
For external framing, phishing-resistant and federated identity guidance matters because it reduces the value of stolen passwords and makes session abuse harder to turn into lasting access. The NIST SP 800-63 Digital Identity Guidelines and OpenID Connect Core 1.0 both help explain why stronger authentication and structured token handling matter when delivery channels are untrusted.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-63 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | IA-2 — Identification and Authentication (Organizational Users) | Stolen credentials and fake login flows exploit user authentication. |
| IA-9 — Identification and Authentication (Non-Organizational Users) | Compromised delivery often targets external users, partners, and contractors. | |
| Recommendation — Use phishing-resistant authentication and limit reliance on reusable passwords. Apply stronger federation and verification for externally authenticated users. | ||
| OWASP ASVS | V6 — Authentication | Malvertising and compromised sites commonly impersonate login and reauthentication flows. |
| V9 — Self-contained Tokens | Session theft and token replay are central identity risks in these attacks. | |
| Recommendation — Verify that authentication flows resist phishing, replay, and credential harvesting. Harden token handling so stolen tokens cannot be easily replayed. | ||
| MITRE ATT&CK | T1078 — Valid Accounts | Attackers use captured credentials or sessions to continue as legitimate users. |
| Recommendation — Hunt for use of valid accounts after suspicious delivery or ad activity. | ||
Practitioner Guidance
What to prioritise: Focus first on identities that can turn a single deceptive click into reusable access, especially admins, developers, finance users, and service accounts with broad token reach. If the exposed material can authenticate to a production system, treat it as a credential incident even if the original issue was web-based.
What to verify: Check whether the campaign is trying to capture passwords, steal session cookies, force MFA fatigue, or deliver code that runs in a trusted browser context. The response differs depending on whether the attacker wants transient access, durable access, or token replay.
Decision rule: If delivery trust and identity trust fail together, prioritise revocation, rotation, and session invalidation before deeper web forensics. The most dangerous mistake is to clean up the site but leave stolen sessions or tokens active.
Practitioner takeaway: Compromised websites and malvertising become identity problems when they can turn user trust into usable access, so the right control boundary is the one that can still block or revoke credentials after the delivery layer has already failed.
Related resources from NHI Mgmt Group
- Why do ERP environments increase identity risk for security teams?
- Why do distributed supply chains increase identity and access risk for security teams?
- How should security teams reduce the risk of a compromised identity provider becoming a single point of failure?
- Why do converged industrial environments increase identity risk for security teams?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 13, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org