thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Foundational

Credential Harvesting

Collecting usernames and passwords from victims, usually through fake login pages or malware.

Definition

Credential harvesting campaigns use cloned login portals, adversary-in-the-middle phishing kits and infostealers to collect credentials at scale. Harvested credentials are used for account takeover, sold, or used in credential stuffing. Phishing-resistant MFA such as FIDO2 defeats most harvesting.

Example

A cloned Microsoft 365 sign-in page hosted on a compromised WordPress site.

Exam tip

Phishing-resistant MFA (FIDO2/passkeys) is the strongest answer against harvesting.

Related terms