What it means
Attackers may phish users, dump memory, steal browser data, capture input, abuse password stores, intercept tokens, or retrieve secrets from files and cloud services.
Why it matters
A compromised credential can make malicious activity look like normal authorized use and enable privilege escalation or lateral movement.
Practical focus
- Protect credential stores and privileged endpoints
- Use phishing-resistant MFA for important access
- Detect unusual token, session, and authentication behavior
- Rotate or revoke all affected credential forms during response
Common mistakes
- Resetting only a password after token theft
- Allowing credentials in scripts and configuration files
- Ignoring service and application identities
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: