The Credential Crisis: How Stolen Credentials Defeat Modern Security
Preventing credential compromise and surviving compromised credentials is not theoretically impossible but is difficult in practice and shows no sign of getting easier. Credentials The modern cyber use of the word ‘credentials’ stems from the Latin ‘creder’: to believe. As society evolved into the Middle Ages, the early notion of ‘Believe me. I am Socrates’ became, ‘Believe this physical letter that proves I am Socrates.’ Those physical letters became known as ‘credentialis’, or a paper that authenticated the bearer. In today’s cyber world, we call that paper ‘credentials. It is no longer physical, but virtual, and the meaning has expanded to ‘you can trust in the belief that I am who I say I am and you can treat me as such: I am Socrates.’ Socrates is the identity, and the credentials prove it. Cyber credentials In cyber today, credentials are largely categorized in two major groups: those for human identities, and those for machine and non-human identities. Human identity credentials can include passwords, passkeys, biometrics, soft and hardware tokens, and more. Non-human identities can include APIs, SSH keys, X.509 certificates, service accounts, session tokens and keys, and more. Session tokens require particular notice since a company may have 3,000 employees, but 300,000 active tokens; and session tokens are scraped by one of credentials’ common beta noirs – infostealers. It is worth remembering there are two stages: the theft of credentials is ‘credential compromise’, while a consequent breach is by ‘compromised credentials’. “Compromise does not necessarily mean the credentials have already been used. It means they are no longer exclusively controlled by the legitimate user,” explains Ran Geva, CEO and co-Founder at Webz.io. But they could be used. And by the nature of what they are, if used, they are automatically trusted as the legitimate user. “The defining trait,” adds Erin Meyers, identity expert at Huntress, “is that the attacker isn’t ‘breaking in’ the traditional way; they’re logging in (or reusing an already-authenticated session) and inheriting the [legitimate] user’s permissions, making malicious activity blend into normal access patterns.” From the system’s perspective, agrees Ariel Parnes, co-founder and COO at Mitiga, “the resulting activity appears authorized, making detection uniquely challenging.” Dan Schiappa, president of technology and services at Arctic Wolf, adds “Credential compromise is one of, if not the most useful and widespread, tactics of threat actors, since it can be carried out with minimal technical skill to gain easy access to target environments.” Sometimes, perhaps too often, the only credentials required are a username and password. In such cases, warns Bob Long, president for the Americas at Daon, “A single simple successful compromise can create a cascade of risk across multiple accounts, especially if the same credentials are reused.” Reinhard Hochrieser, SVP of product and technology at Jumio, warns that social security numbers (SSNs) and government issued IDs are also credentials. “Fraudsters use this data to carry out sophisticated attacks, which include the manipulation of those IDs and the creation of AI-generated deepfakes to bypass biometric checks… making smaller targets like everyday individuals more worthwhile to fraudsters.” Credential compromise, summarizes Jan Bee, CISO at TeamViewer, “allows attackers to bypass perimeter controls, evade detection, and operate inside trusted workflows. As a result, protecting infrastructure alone is no longer sufficient. Protecting identity continuously is now foundational.” Theft of credentials Before a breach can be caused by a compromised credential, the credential must first be acquired (stolen) by an attacker. We can and should make this as difficult as possible, but it is unlikely we will ever be able to prevent the theft of credentials. The primary cause is the traditional agility gap – the time gap between threat actors’ adoption of new techniques and security’s ability to adapt defenses to the new threat. AI provides an excellent example. Phishing remains the primary attack against individual credentials, but AI can produce compelling deepfakes with realistic backstories. There is no technology that can guarantee detection and prevention of this – it largely depends upon the human target’s personal risk tolerance and intuition. Torsten George, CMO at ID Dataweb, comments, “I recently got an email from the CEO. It wasn’t his usual email address, and the tone was a bit off. So, I sent him separately, via Teams, a screenshot of the email and asked him if he had sent it. He hadn’t.” If in doubt, double check. But an attacker doesn’t need to use technology – as Scattered Spider has illustrated. “Pretend to be a high ranking VP, five minutes away from a customer meeting, and you can no longer access your files. Call the Help Desk,” continues George. “That sort of pressure from a superior is often sufficient for the Help Desk person to effectively hand over the keys to the kingdom. This allows the attackers to move laterally until they find the crown jewels and exfiltrate them.” Whether phishing or scamming, it’s all based on social engineering that exploits human weaknesses. Meyers suggests a partial solution can be found in Identity Security Posture Management. “ISPM answers which identities are most likely to be compromised next? It tells you which credentials attackers will target – and why.” It’s not just individual credentials that are under threat. Schiappa comments, “According to our latest threat report, phishing attacks accounted for 85% of all incident responses. However, credential theft attacks can also occur via data exfiltration, infostealer malware and man-in the-the-middle attacks.” Infostealers remain a major threat against credentials. Once on a victim’s system, they scrape passwords (and much more) and send them back to the attacker. The X-Force 2025 Threat Intelligence Index (published February 25, 2026) states that in 400,000 tracked vulnerabilities, 56% required no authentication prior to exploitation. “So, we have attackers exploiting systems through remote code execution without authentication,” comments Michelle Alvarez, manager at X-Force Threat Intelligence. “Maybe they upload a file to a server that does not require authentication, and then boom, they’re in. So, no credentials needed, no MFA to bypass.” And potentially more credentials stolen. Knowing credentials have been compromised If we cannot prevent the theft of credentials, can we at least discover if they have been stolen and are available to bad actors? A stolen credential is an indicator that you could be attacked at any time. As with liberty, the cost of protection is eternal vigilance and is usually elusive. “There are companies that monitor the dark web for breach data and notify individuals if their information appears in exposed datasets, and while that can provide useful insight, it’s not something people can rely on completely,” says Long. “For consumers,” says Renee Burton, VP of threat intel at Infoblox, “one of the easiest ways to check is by using public breach notification services such as haveibeenpwned, where you can enter your email address and see if it has appeared in known data breaches. That can provide some visibility, but it is not a complete picture.” But Hochreiser warns, “Finding out if your credentials have been stolen is nearly impossible. If your email is compromised, you may get a notification, but when it comes to biometrics, there are no public services that can tell you whether or not that data got compromised in a breach.” Parnes suggests, “Use dedicated breach intelligence databases, including public repositories (such as ‘Have I Been Pwned’) and Dark Web Monitoring services (often offered by password managers and identity protection solutions that monitor ‘stealer logs’ – private marketplaces where hackers sell credentials before they ever hit public databases).” There is no simple, single solution. “Detection requires multiple approaches,” says Geva, noting breach dataset monitoring, dark web and marketplace monitoring, infostealer log intelligence, closed forum scraping, and Telegram channel monitoring. It was the complexity and time-consuming nature of monitoring all these sources for every credential loss that prompted Geva to launch the free to use lunarcyber.com (commonly known as Lunar) in late 2025. It does all the monitoring for you (constantly checking signs of compromise). “Lunar gives organizations early visibility into exposed credentials and identity artifacts, so they can act before attackers do,” he explains. “Lunar also includes advanced intelligence focused specifically on infostealer malware, which can indicate when company endpoints have been breached and when attackers have extracted high-value artifacts like session cookies and real-time username/password captures. This matters because even if a user changes their password, stolen sessions and tokens can remain valid and continue to provide access.” From credential compromise to compromised credential breach The basic problem remains: absence of proof is not proof of absence. “Credentials may be misused long before breach information is identified and communicated back to the affected individual. By the time a notification arrives, the attacker may already have exploited the access,” says Long. The first indication of credential compromise for most organizations is the discovery of a breach; but sometimes you can detect the attack before the actual breach. “Unauthorized password reset emails and ‘new login detected’ alerts are a clear signal that your credentials have been stolen,” warns Schiappa. MFA falls into a similar bracket, he continues. “MFA is a simple, effective access control that not only prevents a threat actor from gaining access via stolen credentials but can also serve as a mechanism to alert security teams that unusual login behavior is occurring.” But MFA is no longer perfect. George comments, “If you had asked me 18 months ago, I would have said it is a good deterrent. According to Microsoft, the bypass rate was 0.7% and therefore still within the limits. But today, the MFA bypass rate is in the low double-digit range, which poses a significant threat.” Stuart Sharp, VP of product at One Identity, adds, “Phishing-resistant MFA methods, like WebAuthn and Passkeys, incorporate two levels of protection – validating that the target website address is already known and not a spoofed variation of a valid site, and verifying that the authentication request is coming from a known, registered device. When combined with on-device biometric checks like face ID or fingerprints, these phishing resistant forms of MFA greatly reduce the risk of unauthorized access.” Roy Katmor, CEO at Orchid Security, adds, “MFA is highly effective against simple password replay, but it’s less effective against session theft, token replay, and MFA fatigue/push bombing (where attackers bombard users with prompts until one gets approved) unless it’s properly hardened. Phishing-resistant MFA is a meaningful step up and materially raises the bar.” But at the end of the day, adds George, “The human will always be the weakest link in the cyber attack chain, and that’s what many attackers exploit.” Regardless, “In many cases, people only realize their credentials have been compromised after something goes wrong, such as an unexpected password reset, an account lockout, or fraudulent charges on a credit card. Unfortunately, by the time those warning signs appear, the stolen credentials may already have been circulating or actively used by threat actors,” says Burton. When a compromised credential breach occurs, the game changes to one of early detection and rapid containment. Is there any defense against the use of stolen credentials once the attacker has achieved access? “Yes,” says Meyers, “but the defense shifts from preventing login to containing and outpacing the attacker.” This includes both detecting and slowing the attacker, resetting credentials to prevent further misuse, revocation of active sessions, and enforcing least privilege everywhere. “Once an attacker authenticates, the focus shifts from blocking access to detecting misuse and limiting blast radius,” agrees Bee. “The faster misuse is detected and contained, the smaller the impact.” The two best known tools for detection and containment are behavioral anomaly detection and zero trust principles. Behavioral detection Behavioral detection systems create a baseline of normal user behavior and are able to detect any deviation from that. That deviation is likely to indicate the presence of an intruder, even where access was enabled with valid credentials. “Once attackers authenticate, the giveaway becomes behavior,” says Meyers. Long describes it as continuous authentication. “Instead of trusting a user simply because they logged in successfully once, businesses can monitor behavior throughout the session. Techniques such as behavioral biometrics build a profile of how a customer normally interacts with a service. That can include where they typically are, the devices they use, how they handle that device, and their usual transaction patterns. If something falls outside that normal pattern, the system can step up security the next time the customer attempts an action.” Access, he says, should not be treated as a one-time decision. Bee agrees. “The real question is not whether the login was valid, but whether the behavior that follows aligns with expected identity patterns. If trust is granted once at login and maintained for the entire session, an attacker can operate freely within that window. That is why resilience depends on continuous validation, reassessing whether the user, device, and context remain consistent with what ‘normal’ looks like.” He continues, “Unusual access to new systems, privilege changes, or unfamiliar SaaS activity should trigger re-authentication, session isolation, or immediate revocation. In interconnected, SaaS-driven environments, speed is decisive. The faster misuse is detected and contained, the smaller the impact.” Zero trust Zero trust can assist in credential breach containment, but zero trust is still widely misunderstood as a product or technology. “Zero trust is not a technology. It’s not a product that you can buy off the shelf,” says George. “It is really a concept, a way of thinking; and it simply says, ‘Never trust anything, but rather double check everything’. In today’s dynamic threatscape, that’s an approach that every organization should apply. If you trust credentials, and you believe that a legitimate identity is behind it, you’re in the 70 plus percent of cases where you’re mistaken.” It’s that automatic trust that the attackers leverage. “If you never trust anything, but you really ask further questions, if you don’t automatically assume a credential equals an identity, but check it against things like geolocation, timing of the action, behavioral biometrics – if you can do that in the context of identities, then you’re really minimizing your risk exposure tremendously.” Carlos Aguilar Melchor, principal research scientist at SandboxAQ, agrees. “Zero Trust is a way of operating, not a finish line. The goal is simple: keep shrinking blast radius wherever identity and cryptography are well governed and enforced. “The old perimeter is gone,” he continues. “Keep moving to continuous verification across users, devices, services, data, and agents. Make every transaction check policy, and treat identity as the control plane for both people and machines.” While zero trust is neither a product nor a finish line, “Partial zero trust is still worth doing if you can measure it,” he suggests. “Start with phishing-resistant MFA, signed software and models, workload identity, and service-to-service mutual Transport Layer Security (mTLS). Keep crypto strong so machine identities stay trustworthy.” It is the continuous verification that is important, says Meyers. “Zero trust is strong against ‘credential = keys to the kingdom’ thinking, because it emphasizes continuous verification and conditional access. Most notably, zero trust shines when paired with enforcement that catches trust boundary violations and limits lateral movement after initial access.” Microsegmentation, often considered to be a key aspect in implementing the zero trust concept, is a strategy rather than a technology. It is useful in containing an intruder. “It limits the ‘blast radius’ by ensuring one compromised account cannot move freely across the entire network,” comments Parnes. ‘Freely’ is the key word. It doesn’t prevent lateral movement, but it slows it down. That alone could be enough. Cybercriminals don’t like to hang around, which could lead to exposure and unintended consequences. If things get tough, they are quite likely to leave and move on to the next victim. The agility gap in action One thing we haven’t mentioned but really should, is the effect of stolen API keys for agentic AI systems. The speed of full compromise and the potential blast radius are both increased exponentially, and the threat surface (the use of agentic AI systems within and by business) is expanding dramatically. It is another example of AI expanding the agility gap. This API key isn’t simply capable of unlocking the data store, it is the key to an agent who is effectively a trusted employee able to talk to other similarly trusted employees, roam freely through the network and act autonomously. It has access beyond datasets into workflows. Since agents are necessarily trusted by the system, they are unlikely to trip any detection mechanism or be delayed by firewalls until after it or they act. Once into the agentic system, the attacker effectively has access to every system or platform (Jira, Slack, AWS, etcetera) the agentic system integrates with. Such an attacker, unlikely to be detected, could explore possibilities available through the agentic system, and then strike. This strike could include thousands of malicious actions at machine speed across the victim’s entire infrastructure before it is detected. With stolen API keys, possible detection and containment is low, and blast radius is high. The future “I think, quite frankly, as with any type of attack, the threat actors will always be a step ahead of us,” says George. “It is our task to reduce the agility gap between the attacker and defender as far as possible, but we will never eliminate it. We will never be able to completely protect against any attack, including against identity-based attacks. And to any vendor or professional that claims 100% protection… you should laugh at them.” Related: Autonomous AI Agents Provide New Class of Supply Chain Attack Related: Cybercriminals Trade 183 Million Stolen Credentials on Telegram, Dark Forums Related: The Wild West of Agentic AI – An Attack Surface CISOs Can’t Afford to Ignore Related: Cyber Insights 2026: Zero Trust and Following the Path Related: 136 NPM Packages Delivering Infostealers Downloaded 100,000 Times
securityweek.comMay 27, 2026extracted