Credential harvesting
Also called credential theft, credential harvest, harvesting credentials
Collecting usernames, passwords, tokens and keys in bulk, to break in with them later or to sell them.
A credential is anything that proves you are allowed in: a password, a sign-in token, a session cookie, an API key. Credential harvesting is gathering them at scale, from many people or many systems at once.
The methods vary. Fake sign-in pages collect what people type. Malware copies what browsers have saved. Scripts search exposed servers and code for keys left in files. What they share is that the harvest comes first and the break-in later.
AI has made the gathering close to free. Agents can find the targets, write the tooling and fix their own errors without a person stepping in. Stolen credentials remain one of the main ways into an organisation.
For example
A fake sign-in page copies every password typed into it, and a script gathers the access keys left in exposed files across thousands of sites.
Put it to use
Where you'll meet credential harvesting in ChatGPT, Gemini and Claude, how to use it there, and the mix-up most people make.
Daily Bytes Plus is in the Android app.