Credential Theft

Credential Theft covers the technique of obtaining login credentials, passwords, session tokens, or MFA codes through phishing, vishing, infostealer malware, or similar means. It describes how access was gained, not an actor's classification, so pair it with the relevant actor or campaign tag. Distinct from Credential Stuffing, which covers reusing already-breached credentials against a new target.