🔑
Credential Harvesting
Critical Severity86% of organizations experienced credential theft attempts in 2023
Credential harvesting is an attack where phishing emails direct victims to fake login pages designed to capture usernames and passwords for email, banking, or other services.
How it works
- Email claims your account needs verification or has been compromised
- Link goes to a pixel-perfect replica of a real login page
- Victim enters their real credentials which are captured
- Attacker uses credentials for account takeover, data theft, or further attacks
Red flags to watch for
- Unexpected "verify your account" or "reset password" emails
- Login page URL doesn't match the real service domain
- Page asks for more information than a normal login (SSN, credit card)
- Redirects to the real site after "login" to avoid suspicion
Real-world example
Subject: Action Required: Unusual sign-in activity on your Microsoft account
From: account-security@microsoftonline-verify.com
“We detected a sign-in attempt from an unrecognized device. If this wasn't you, secure your account immediately by verifying your identity.”
How to protect yourself
- Always check the URL before entering credentials
- Use a password manager that won't autofill on fake domains
- Enable multi-factor authentication everywhere
- Use SiftMail to label credential harvesting emails the moment they land
How SiftMail detects this
SiftMail scores phishing body patterns (+30%) including password reset language, SSN/credit card requests, and credential verification urgency. Combined with sender analysis, these emails are consistently flagged.
Spot credential harvesting the moment they land
SiftMail scores every email after delivery and labels the risky ones. Preview what it found, confirm, and archive in one pass. Free plan available, setup takes 30 seconds.