PH!SH Framework
Framework / Techniques /Direct Data Harvesting
Sub-technique Data Harvesting

Login Credential Collection

A page or form collects account sign-in details, such as a password, a one-time code, or a recovery code. Whatever is entered goes to whoever runs the form, who can use it to sign in to the account.

Also known as
Aliases
  • credential harvesting
  • fake login page
  • credential phishing
Named examples
  • LabHost
  • 16Shop
  • Caffeine
Mapped to
MITRE ATT&CK®
T1598.003Spearphishing Link
Inherited from the parent entry.

Connected in PH!SH

Themes
TH0002Email Service Impersonation TH0009Microsoft Impersonation TH0011.2IT Department Impersonation TH0029Collaboration Platform Impersonation TH0033Storage Quota Warning TH0034Password Expiration Notice TH0035MFA Request TH0036Account Suspension or Deletion Notice TH0037Suspicious Sign-In Alert TH0038Security Update Notice TH0039Account Details Update TH0040Quarantined Email Notice TH0045Account Verification Request TH0046Enterprise System Impersonation TH0047Email Delivery Failure Notice TH0061Copyright or Platform Policy Violation Notice TH0069Data Breach Notice