Credential theft

Credential theft is the stealing of authentication secrets, such as passwords, API access keys, SSH keys and session tokens, so an attacker can sign in as a legitimate user or service. Actions taken with stolen credentials look like normal administration, which makes them hard to detect and makes backup administrator accounts a high-value target.

Why do attackers sign in instead of exploiting a flaw?

Valid credentials give access without any exploit, and security tools built to detect intrusion see an authorized identity performing authorized actions. The Verizon 2025 Data Breach Investigations Report found that credential abuse was the initial attack vector in 22% of breaches, ahead of the exploitation of software vulnerabilities.

Which credentials are stolen, and how?

  • Passwords: captured by fake login pages, recorded by malware on an administrator's device, or reused from earlier leaks and tried against VPNs and consoles.
  • API access keys and SSH keys: long-lived secrets found in scripts, configuration files and code repositories. They usually bypass multi-factor sign-in, because services use them without a person present.
  • Session tokens: issued after a successful sign-in, including the second factor. A proxy-based phishing page or malware that copies browser data can take the token, and replaying it gives the attacker the signed-in session without logging in again.
  • Cloud and identity tokens: temporary credentials from identity and access management (IAM) services, stolen from compromised hosts and used until they expire.
  • Help desk resets: a convincing request to reset a password or enroll a new second factor.

A first stolen credential is often used to find more, working toward accounts that control identity, virtualization and backup. Stolen access is also sold to ransomware as a service affiliates, so the thief and the attacker are often different people.

What can a stolen backup login do?

A stolen backup administrator login can delete restore points, shorten retention or disable jobs through the same controls staff use daily. Without monitoring for mass deletions or retention changes, nothing looks unusual. A stolen storage access key can delete stored backup objects directly. How much one credential reaches is its administrative blast radius: when one domain account covers production, the hypervisor and the backups, one theft exposes all three.

What limits the damage from a stolen credential?

Zero trust security narrows reach by verifying each request and granting each identity only what it needs. For backups, the firmest limit is retention enforced by the storage rather than the console. Under S3 Object Lock in compliance mode, locked copies cannot be deleted by any account, root included, before their retention date, so a stolen credential can request deletion without erasing anything. Using a stolen credential to alter or delete copies is backup tampering, and using it to copy data out is data exfiltration.

Frequently asked questions

What is the difference between credential theft and credential stuffing?

Credential stuffing is one technique: trying passwords leaked from one site against others. Credential theft covers every way of obtaining credentials, including phishing, malware, exposed keys and stolen session tokens.

Does multi-factor authentication stop credential theft?

It raises the cost of an attack, but a proxy phishing page can capture the session token issued after sign-in, and access keys used by services often have no second factor at all.

Can backups survive a stolen administrator login?

If retention is enforced by the storage in compliance mode, locked copies cannot be deleted by any account before their retention date, whoever's login is used.