What is credential phishing?
Credential phishing is phishing designed to capture usernames and passwords, and increasingly MFA codes and session tokens, on a fake sign-in page that looks like Microsoft 365, Google, Okta or a bank.
How it works
Adversary-in-the-middle kits relay the victim’s sign-in to the real service in real time, so they capture the session even when the person completes MFA. Phishing-resistant MFA, such as passkeys and FIDO2 keys, defeats this relay.
Stolen credentials are sold, reused across services, and used for account takeover and business email compromise.
Why it matters
A valid sign-in looks like normal activity to most controls. Stopping credential phishing early prevents the account takeover that follows.
