SecurityRingBook a Demo

Glossary

What is credential harvesting?

Collecting usernames and passwords by luring people to a fake sign-in page or form, usually from a phishing email or message.

How it works

The joint CISA, NSA, FBI and MS-ISAC phishing guidance of October 2023 outlines the phishing techniques attackers commonly use, including credential phishing. The victim is sent to a page that imitates a real login and enters their details, which the attacker then uses to sign in.

A real example

Microsoft documented a campaign that, from September 2021, attempted to target more than 10,000 organisations with fake Office 365 sign-in pages. The pages even showed the target organisation’s own branding, and the URL was the only visible difference from the real site.

How to train for it

  • Check the address bar before you type a password.
  • Open sign-in pages from your own bookmark rather than an email link.
  • Use a password manager: it will not autofill on a lookalike domain.

Credential harvesting is a live SecurityRing email simulation. Typed values on the simulated page are not stored; the employee goes straight to a lesson on the email they received.

Sources

Every clause, incident and figure above comes from these official or original sources.

  1. CISA, NSA, FBI and MS-ISACPhishing Guidance: Stopping the Attack Cycle at Phase OnePublished 18 October 2023 · Accessed 17 October 2026.
  2. Microsoft Threat IntelligenceFrom cookie theft to BEC: Attackers use AiTM phishing sites as entry point to further financial fraudPublished 12 July 2022 · Accessed 17 October 2026.