Security Glossary
Credential Harvesting
Credential harvesting is a phishing technique where attackers create fake login pages that look identical to your real login page — capturing usernames and passwords when victims attempt to sign in.
How Credential Harvesting Works
- Clone the target: Attackers copy the visual appearance of a legitimate login page
- Register a lookalike domain: They host the clone on a typosquat or homoglyph domain
- Obtain SSL certificate: A valid HTTPS certificate makes the site appear trustworthy
- Distribute links: Phishing emails, SMS, or malicious ads direct victims to the fake page
- Capture credentials: When users enter their login details, attackers receive them instantly
- Redirect to real site: Victims are often forwarded to the real login page to hide the attack
The AI Acceleration
Generative AI has made credential harvesting dramatically easier. Attackers can now:
- Clone entire login pages in seconds using AI tools
- Generate convincing phishing emails in multiple languages
- Create personalized lures using scraped data
- Automate the entire attack chain from domain registration to credential capture
This is why continuous monitoring is essential — the window between an attack going live and your customers getting hurt has shrunk to minutes.
Indicators of Credential Harvesting Sites
- Login forms: Presence of username/password input fields
- Brand assets: Logos, color schemes, and UI patterns matching your brand
- Form actions: POST requests to suspicious endpoints
- Recent registration: Domain registered within the last 30 days
- Privacy proxy: WHOIS hidden behind registrar privacy services
How Impersona.io Detects Credential Harvesting
Impersona.io crawls suspected lookalike domains to detect credential harvesting signals: login forms, brand asset similarity, and suspicious form destinations. Each finding includes a screenshot, DOM analysis, and risk scoring to help you prioritize response.
Frequently Asked Questions
What is credential harvesting?
Credential harvesting is a phishing technique where attackers create convincing replicas of legitimate login pages to trick users into entering their usernames and passwords, which are then captured by the attacker.
How do attackers create credential harvesting pages?
Attackers clone the visual appearance of legitimate login pages, host them on lookalike domains, and lure victims through phishing emails, malicious ads, or compromised websites. AI tools now make this trivially easy.
How can I protect my brand from credential harvesting?
Monitor for lookalike domains hosting cloned login pages, implement DMARC to reduce email spoofing, educate users about phishing, and quickly take down credential harvesting sites when detected.
Related Terms
Find credential harvesting sites targeting your brand
Run a free brand check to detect lookalike domains that may be hosting fake login pages.