Credential Stealer

Expanded Definition

A credential stealer is malware built to harvest reusable authentication material from endpoints and developer workflows, including passwords, API keys, browser session cookies, tokens, and local certificates. In NHI environments, the threat matters because software agents, build systems, and cloud tooling often keep credentials close to execution context rather than in isolated vaults.

Definitions vary across vendors on whether a credential stealer must exfiltrate only secrets or also session artifacts and browser state, but the operational impact is the same: the attacker gets a ready-to-use identity, not just stolen data. That distinction makes this class different from generic data theft or broad ransomware activity, because the primary objective is impersonation and lateral movement using valid access paths. Guidance in the OWASP Non-Human Identity Top 10 aligns with this reality by treating exposed NHI material as an access control failure, not merely a confidentiality event.

The most common misapplication is calling any malware a credential stealer, which occurs when defenders do not separate token harvesting from destructive or extortion-only payloads.

Examples and Use Cases

Implementing detection and response for credential stealers often introduces friction for developers and platform teams, because tighter controls around browsers, shells, and CI runners can slow down legitimate automation unless secrets are issued dynamically.

• A developer workstation stores cloud CLI credentials in a local profile, and malware copies the file before the user notices abnormal sign-in activity.
• A CI/CD runner caches tokens and certificates on disk, allowing a stealer to pull signing material and impersonate deployment automation, a pattern echoed in the Reviewdog GitHub Action supply chain attack.
• A browser extension or infostealer harvests session cookies from a logged-in SaaS console, bypassing passwords entirely and preserving the attacker’s access until the session is revoked.
• An exposed cloud access key is captured from a compromised endpoint and then used within minutes, consistent with LLMjacking: How Attackers Hijack AI Using Compromised NHIs research showing rapid attacker use after exposure.
• A build agent pulls secrets from environment variables during a job, and the malware reads process memory or logs to recover them for later abuse.

For identity hygiene, teams should pair endpoint hardening with the NIST SP 800-63 Digital Identity Guidelines and reduce persistent secret storage wherever possible.

Why It Matters in NHI Security

Credential stealers turn one infected machine into an identity breach because the attacker inherits the same access paths used by legitimate automation. Once secrets are copied, blast radius depends on how broadly those credentials were reused, whether they were static or ephemeral, and whether the organisation can distinguish benign service activity from adversary use. The Ultimate Guide to NHIs — Static vs Dynamic Secrets is especially relevant here: static secrets magnify the value of every successful steal, while dynamic credentials narrow the window for abuse.

NHIMG research shows the problem is still common, with 23.7% of organisations sharing secrets through insecure methods such as email or messaging applications, which gives credential stealers multiple easy collection points. The same research also reports that only 19.6% of security professionals are strongly confident in their organisation’s ability to securely manage non-human workload identities, underscoring how often these theft events exploit weak governance rather than advanced tradecraft. Controls from Guide to the Secret Sprawl Challenge and NIST SP 800-53 Rev 5 Security and Privacy Controls both reinforce that secrets must be inventoried, rotated, and constrained to least privilege.

Organisations typically encounter the operational cost of credential stealer activity only after anomalous cloud usage, token replay, or unexpected deployment changes reveal that a stolen identity has already been used.

Related resources from NHI Mgmt Group

• What is the difference between an identity, a credential, and a secret?
• What is credential injection risk and how does it occur?
• What is the most common mistake organisations make with NHI credential management?
• How do I respond to a confirmed NHI credential compromise?