On September 8, Google Threat Intelligence Group (GTIG) detailed several attacks that show how quickly AI is changing the economics of cybercrime.
In one credential-harvesting campaign, a threat actor first compromised an organization’s cloud infrastructure, then built and deployed a multi-agent attack framework. The operation took less than six hours in total and resulted in thousands of third-party credentials being compromised.
The AI even managed parts of the vulnerability-scanning pipeline, troubleshot problems as they arose and rotated IP addresses with minimal human intervention.
One of the main benefits of AI for organizations is the productivity gains it can deliver. Unfortunately, threat actors can use those same capabilities to make attacks faster and easier to scale. Credentials are already routinely harvested through infostealers, and AI simply removes some of the work required to carry attacks out.
As credentials are becoming easier to steal at scale, security teams must ensure their current authentication processes are robust enough to confidently establish that users and devices connecting to internal networks are trustworthy.
AI is Automating the Credential Theft Playbook
Microsoft reported in April that AI-assisted phishing campaigns it observed were achieving click-through rates as high as 54%, compared with around 12% for traditional campaigns.
If attackers can make the same campaign more convincing without spending proportionally more time creating it, the economics of phishing start to shift in their favor. For credential theft, that’s especially important as it’s partly a numbers game. Not every recipient will click, and even those accounts that do become compromised may not provide useful access.
With AI, attackers can generate targeted messages more quickly, adapt them for different languages or industries, and create variations without writing each one from scratch. Improving the success rate at the start of that process gives attackers more credentials to test and more opportunities to find the accounts that matter.
AI therefore doesn’t need to introduce a new way to steal credentials to change the risk for organizations. Making established techniques more efficient is enough.
Verizon’s Data Breach Investigation Report found stolen credentials are involved in 44.7% of breaches.
Effortlessly secure Active Directory with compliant password policies, blocking 4+ billion compromised passwords, boosting security, and slashing support hassles!
How to Uncover Compromised Credentials in Your Active Directory
AI may make credential theft faster and easier to scale, but attackers still benefit from familiar weaknesses such as weak and reused passwords. That makes visibility a useful first step. Before security teams can reduce credential exposure, they need to know where the weaknesses are in their own environment.
Specops Password Auditor performs a read-only scan of your Active Directory to identify password-related vulnerabilities and highlight issues with users and password policies.
The resulting report gives security teams a clearer view of where credential risk exists today, so they can prioritize what needs attention.
Download Specops Password Auditor for free here.
Successful Authentication isn’t Necessarily Trustworthy
The threat of stolen credentials is straightforward: they let an attacker use the same access routes as a legitimate user. Identity weaknesses played a material role in 89% of investigations covered by Unit 42’s 2026 Global Incident Response Report, with attackers using stolen credentials and tokens to gain access and move through environments.
Abusing valid identities changes what malicious activity looks like to defenders. There may be no exploit attempt or obviously malicious login mechanism to spot.
An attacker can access cloud services, SaaS applications and other resources through the same authentication processes employees use every day. The credentials are valid; the intent behind them is not.
The key issue for security teams is that, wherever credentials are stolen from, they provide valuable access that an organization’s authentication system is designed to accept.
This is where the distinction between authentication and trust starts to matter. A correct password, MFA response, or valid session can help establish that an authentication requirement has been met. It cannot, by itself, establish that the request is coming from a device the organization knows and trusts.
When building an identity security strategy that is truly resilient against AI-enabled attacks, the question therefore cannot stop at “Did this user authenticate successfully?” It also needs to include “What device is requesting access, and should we trust it?”
Make Stolen Credentials Less Useful
Password hygiene can reduce exposure, but no organization can assume credentials will never be compromised. The prevalence of credential harvesting malware creates situations where an attacker may end up with valid authentication material despite preventative controls.
The next question is what that credential can do.
If authentication is restricted to devices that have already been approved and bound to a user’s identity, a valid password alone is no longer enough. An attacker trying to reuse it from an unknown device has another trust check to overcome.
That is the role of solutions like Specops Device Trust. It binds user identities to trusted devices, so access depends on both who is authenticating and what device they are logging in from. In practice, that means a stolen credential used from an attacker-controlled machine will simply be blocked.
Zero Trust measures like this especially matter across a mixed workforce. BYOD policies spanning different operating systems and endpoint types are common, and it can be a challenge to implement security measures that cover them all.
Specops Device Trust applies device trust across Windows, macOS, Linux and mobile, meaning security teams have visibility over every device connecting to the network.
The principle is simple: authenticate the identity, verify the device, and require both.
Evolve Your Identity Security Strategy with Specops
AI is making credential theft faster and more scalable; it’s harder to trust traditional authentication signals alone. Strong password hygiene remains essential, but organizations also need to think about what happens when valid credentials or tokens fall into the wrong hands.
That means evolving identity security beyond “did this user authenticate?” to include whether the device is trusted and whether it remains trustworthy throughout the session.
Specops can help you better align with Zero Trust principles by bringing device trust into your identity security strategy. Book a demo to see our solutions in action.
Sponsored and written by Specops Software.
