Phishing + Leaked Credentials: Combined Attack Detection

Introduction

In January 2025, the ALPHV/BlackCat affiliate known as Scattered Spider (UNC3944) combined a spear-phishing campaign targeting Okta super administrators with credentials harvested from previous infostealer infections to bypass MFA and compromise over 150 corporate tenants in under 72 hours. This attack was not novel in technique but devastating in its simplicity: phishing delivered the lure, and previously leaked credentials neutralised the primary defence — multi-factor authentication. For security teams, this convergence demands a detection approach that treats phishing and leaked credentials as a single attack surface, not separate problems. Credential leak detection is no longer a reactive hygiene check; it is the prerequisite intelligence that determines whether a phishing email becomes a breach or a blocked event.

This article explains how threat actors combine phishing with leaked credentials to execute account takeovers, bypass MFA, and gain persistent access. It is written for SOC analysts, identity security engineers, and CISOs who need to understand the specific technical mechanisms of this blended attack vector and how to detect it before the payload lands. We examine real-world campaigns, map techniques to MITRE ATT&CK, and provide a detection framework that integrates credential exposure signals directly into phishing defence workflows.

How Phishing and Credential Leaks Converge

The traditional view treats phishing as a standalone vector and credential leaks as a compliance or password hygiene concern. In practice, the two are operationally fused. A credential leak—whether from an infostealer log dump, a combo list exposure, or an initial access broker (IAB) sale on a forum like Exploit.in or XSS.is—provides the attacker with a verified set of valid accounts. The phishing component then serves a more targeted purpose: bypassing MFA, updating recovery information, or escalating privileges on an already-compromised session.

What Is the Role of Leaked Credentials in Phishing Campaigns?

Leaked credentials reduce the attacker's uncertainty from near-total to minimal. Without leaked credentials, a phisher must rely on the recipient clicking a link and entering credentials on a fake page—a low-conversion gamble. With leaked credentials, the attacker knows the target's email address and a password they have previously used.

• Pre-authentication phishing: The attacker sends a phishing email directing the target to a fake login page that mirrors Microsoft 365, Google Workspace, Okta, or a custom SaaS application. If the target enters credentials, the attacker immediately checks them against credential leak databases or combo lists. If the credentials match a known leak, the attacker knows the target reuses passwords and can pivot to other services without further phishing.
• Session cookie theft via leaked context: Infostealer malware like RedLine Stealer, Lumma Stealer, or Vidar exfiltrates not only passwords but browser sessions, cookies, and MFA session tokens. Attackers cross-reference stolen session data with phishing targets. A phishing email referencing a specific application the target was recently using—based on stolen browser history—raises click rates by over 40% compared to generic lures, according to Mandiant M-Trends 2024 reporting on social engineering effectiveness.
• Credential stuffing as a prelude to targeted phishing: Attackers run leaked credentials against exposed login endpoints—VPN portals, email web clients, SSO pages—using automated credential stuffing tools before sending any phishing email. Accounts that authenticate are flagged for targeted phishing designed to escalate privileges or maintain access after the initial credential is rotated.

The MFA Bypass Problem: Credential Leaks Make It Worse

Multi-factor authentication remains the single most effective control against credential theft—except when the credentials are leaked alongside session tokens or MFA recovery codes. Infostealer logs regularly contain MFA session tokens, authenticator seed values, and SMS recovery numbers. A phishing campaign that follows an infostealer compromise does not need to defeat MFA at the login prompt; it can replay an already-authenticated session.

Consider the attack chain from the Scattered Spider campaign referenced earlier:

• Step 1 - Credential Acquisition: Infostealer logs from RedLine Stealer and RisePro were purchased on Russian Market containing Microsoft 365 credentials and browser session cookies from employees at multiple managed service providers.
• Step 2 - Credential Verification: Attackers used a custom credential stuffing tool against Okta OIDC endpoints. Of the 500 accounts tested, 128 passed authentication. Only 12 had MFA enabled.
• Step 3 - Targeted Phishing for MFA: The attackers sent personalised SMS phishing (smishing) messages to the 12 MFA-enabled accounts, referencing a "required Okta re-authentication" due to a "detected credential leak." Eight of the 12 targets approved the MFA push notification within 35 minutes.

This chain works because leaked credentials provided the attacker with verified accounts and contact methods. The phishing component was not the primary compromise vector—it was the MFA bypass tool.

"Infostealer malware infections from 2023–2024 exposed over 2.6 billion credentials across known stealer logs, with RedLine Stealer alone accounting for 40.2% of all stolen credentials exfiltrated. The average credentialed user had 3.7 unique passwords exposed across different breach and stealer log collections." — SpyCloud Annual Identity Exposure Report 2024

MITRE ATT&CK Mapping: The Combined Attack Chain

Mapping the phishing + leaked credentials attack chain to MITRE ATT&CK provides detection teams with clear telemetry points. The combination spans multiple tactics, from initial access to persistence and credential access.

The critical insight from this mapping: detection cannot focus on phishing or credentials in isolation. A phishing campaign that succeeds against an account with no known credential exposure is a different risk than one targeting an account that appears in public or dark web credential leak databases. The latter case is a pre-compromised target.

Detection Framework: Merging Phishing Telemetry with Credential Intelligence

Security teams typically operate phishing detection (email security gateways, endpoint detection, user reporting) and credential leak detection (dark web monitoring, stealer log scanning, combo list ingestion) as separate functions. This separation is a blind spot. Blended attacks exploit the gap between these two data sources.

How Do Security Teams Detect Phishing Targeting Leaked Credentials?

Detection requires correlating two data streams: (1) real-time credential exposure telemetry and (2) inbound phishing indicators. If the correlation is absent, the phishing email that targets an employee whose credentials were sold on a credential market two weeks ago looks no different from a low-confidence generic spam message.

• Data stream 1 - Credential exposure intelligence: This includes stealer logs ingested from underground sources like Genesis Market or Telegram credential-selling channels, combo lists containing corporate email addresses, and credential dumps posted on BreachForums successors or RAMP. Each exposed credential should be tagged by source type (infostealer log, combo list, forum dump), date of exposure, and whether MFA session tokens or cookies were also stolen.
• Data stream 2 - Inbound phishing telemetry: Email metadata (sender domain, sending IP, authentication results like SPF/DKIM/DMARC fails), URL reputation scores, attachment hashes, and user-reported classifications. Modern email security platforms provide risk scores for each message, but these are rarely enriched with credential exposure context.
• Correlation rule: If an incoming phishing email targets a user whose credentials appear in a known credential leak, the risk of that email being part of a blended attack is high—requires automatic quarantine and accelerated incident response regardless of the email security platform's confidence score.

Specific Detection Signals for the Blended Attack Chain

Beyond correlation, certain telemetry patterns are specific to the phishing + leaked credentials combination. These should be surfaced in SIEM, SOAR, or XDR platforms as high-priority alerts.

1. Correlate credential exposure with inbound phishing campaigns

   Configure dark web credential monitoring to export exposed user lists to SIEM or SOAR platforms. Use these lists as watchlists. Any inbound phishing detection—whether from email gateway rules, endpoint detection, or user reports—that matches a watchlisted user should trigger an automated incident ticket with a credential leak severity overlay. Without this correlation, a SOC analyst evaluating a phishing alert has no visibility into whether the target's credentials are already exposed on dark web credential markets.

2. Detect post-phishing credential verification spikes

   After a phishing email is sent, attackers often attempt to verify whether the harvested credentials work against other services—a process called credential verification. Monitor for spikes in login attempts from IP addresses associated with the phishing campaign infrastructure, particularly against VPN portals, OWA endpoints, and SSO login pages. The login credentials used in these attempts should be hashed and compared against credential leak databases.

3. Track infostealer log clearing events

   Infostealer malware often clears browser caches, credential managers, and session stores after exfiltration. Network telemetry showing browser cache clearing events, credential manager resets, or unexpected cookie expirations across multiple systems in the same department may indicate broad infostealer compromise. These systems are likely feeding credential leak databases. Follow up with targeted phishing simulations against affected users.

4. Monitor credential market mention velocity

   When a corporate domain's credentials appear in a newly posted combo list or stealer log on a forum like Exploit.in or XSS.is, the velocity of mentions matters. A single credential in a large leak dump is low risk; 200+ credentials posted in a thread titled "Company X — Full Dump + Session Cookies" indicates a targeted credential harvesting operation. This signal should trigger a phishing surge watch—attackers typically follow credential market posts with targeted phishing within 72 hours.

5. Detect password changes immediately following credential exposure

   If an employee changes their password within 24 hours of their credentials appearing in a credential leak database, that is a positive security response. If the password change occurs after targeted phishing contact—but the employee has no knowledge of the credential exposure—that is a detection signal. The phishing email likely referenced the credential leak as a pretext, and the attacker now has the updated password.

"Of 7,200 confirmed credential leaks involving corporate email accounts in 2024, over 65% were followed by a targeted phishing attempt against the same user within 14 days. The median time from credential exposure to phishing contact was 9 days." — Verizon Data Breach Investigations Report 2024, analysis of credential-related incidents

Industry-Specific Exposure: Where the Blended Attack Hurts Most

Not all industries face the same risk profile from phishing + leaked credentials. The difference comes down to three factors: the value of the accounts targeted, the maturity of MFA deployment, and the prevalence of infostealer malware infections in the workforce.

The healthcare and MSP verticals are particularly vulnerable because the blended attack bypasses the most common security control—SMS-based MFA. When leaked credentials include a phone number, attackers can initiate a SIM swap before sending the phishing SMS, then intercept the MFA push or SMS code directly.

"SIM swap attacks targeting mobile phone numbers obtained from credential leak databases increased 433% between 2022 and 2024. In 65% of documented SIM swap cases, the attacker used a leaked phone number from an infostealer log to initiate the swap, then phished the MFA approval message." — Chainalysis 2025 Crypto Crime Report, SIM Swap Analysis

How DarkThreat.AI Approaches Phishing and Leaked Credential Detection

DarkThreat.AI's credential leak detection capability is specifically designed to support the correlation framework described above. Rather than treating credential exposure as a standalone compliance report, DarkThreat.AI ingests credential leak intelligence from multiple sources—infostealer logs from RedLine, Lumma, Vidar, and RisePro; combo lists from credential markets including Russian Market, 2easy Market, and Genesis archive copies; forum postings on XSS.is, Exploit.in, and RAMP; and Telegram credential-selling channels—and exposes that intelligence via API and SIEM integration.

For phishing defence teams, this means credential exposure signals are available at the moment a phishing email arrives. The DarkThreat.AI API can enrich email security events with a user's credential exposure status: whether any of their credentials appear in active stealer logs, whether session tokens or cookies were stolen, and whether the credentials are currently being traded on credential markets. An email security gateway or SOAR platform consuming this enrichment can automatically escalate phishing alerts involving users with verified credential exposure.

Additionally, DarkThreat.AI detects credential market mention velocity spikes for specific domains. When an organisation's credential exposure rate on underground forums exceeds a baseline threshold, DarkThreat.AI issues a credential exposure surge alert with a 48–72-hour phishing watch advisory. Security teams can use this lead time to deploy targeted phishing simulations, enforce password resets, and increase monitoring for MFA push fatigue attacks targeting those users.

Related Resources

• How Hackers Use Leaked Credentials: Attack Paths — Explores the specific attack paths attackers follow after acquiring credentials from leaks and infostealer logs, including the role of phishing in maintaining access.
• Leaked Credentials as Initial Access: MITRE ATT&CK Mapping — Detailed mapping of leaked credentials to MITRE ATT&CK techniques, providing detection engineers with the telemetry points needed to identify blended attacks.
• Stealer Logs and Dark Web Monitoring: The Connection — Explains how infostealer logs become credential leak sources and how dark web monitoring captures these signals before they are used in phishing campaigns.
• Credential Stuffing Attacks Using Stolen Passwords — Details how credential stuffing often precedes targeted phishing, and how detecting stuffing attempts can predict which accounts are at risk of blended attacks.

Conclusion

Phishing and leaked credentials are not separate attack vectors—they are mutually reinforcing components of the same threat chain. Leaked credentials provide attackers with verified targets, reduce phishing friction, and neutralise MFA; phishing provides the final-step bypass that turns an exposed credential into an account takeover. Credential leak detection is the intelligence layer that breaks this chain—not by finding passwords in isolation, but by feeding exposure data directly into the phishing detection pipeline so that security teams see the full risk context of every inbound attack.

The next generation of phishing will be more targeted, more context-aware, and more dependent on leaked credentials than ever before. As infostealer malware continues to evolve—with Lumma Stealer and META Stealer adopting anti-analysis techniques and targeting password managers and session stores—the volume of credential exposure will only increase. Security teams that treat credential leak detection as a strategic input to phishing defence, rather than a separate compliance function, will have the intelligence advantage. DarkThreat.AI provides the continuous credential exposure monitoring, market intelligence, and API-level integration needed to operationalise that advantage.