threats

Credential Phishing

Updated October 16, 2026

Credential phishing is an attempt to trick someone into revealing login information, usually through a deceptive message and a counterfeit sign-in experience. Targets can include passwords and one-time codes. Related attacks may capture a session or request application permissions instead, so the response depends on what the person actually did.

2 min. read

What do I need to know about Credential Phishing?

A sign-in page can copy familiar branding and use HTTPS while still being controlled by an attacker.
Distinguish receiving a message, opening its link, entering a password, approving MFA, and granting application access. These are different exposure events.
Password resets may be necessary after disclosure, but sessions, authentication methods, forwarding rules, and application grants also need review.
Phishing-resistant authentication reduces deceptive sign-in risk; it does not make every message or compromised endpoint safe.

An illustrative example

An employee follows a “shared document” email and enters a Microsoft 365 password. The page then displays an error. Record the address visited and approximate time without asking the employee to revisit it. That timeline lets responders connect the email to subsequent sign-ins, mailbox changes, and other affected users.

Practical checks

Report the message and tell the response team exactly what was entered or approved.
Use a trusted device and the legitimate service to secure the account under your organization’s response process.
Investigate related sessions, MFA registrations, app consent, forwarding, and messages sent during the exposure window.

Five FAQs about Credential Phishing

Is clicking a phishing link the same as giving away my password?

No. Clicking can expose information or lead to further harm, but it does not automatically mean credentials were entered. Report the click and distinguish it from a login, download, or permission grant.

What if the fake page used a padlock?

HTTPS encrypts the connection to that site. It does not establish that the site belongs to the organization it claims to represent. Use the known application or a trusted bookmark for sign-in.

Should I change a reused password elsewhere?

If that password was disclosed, secure other accounts that reuse it, starting with important services. Use unique passwords and appropriate MFA. Make changes through legitimate services from a trusted device.

Is resetting the password enough?

Do not assume so. Responders should assess active access and persistence, including sessions, app grants, forwarding, and authentication methods. The exact steps depend on the identity provider and the evidence.

Can a legitimate file-sharing service carry a phishing lure?

Yes. A trusted service can host or deliver a message that points to a malicious destination. Evaluate the requested action and destination, not just the service that sent the notification.