Post-compromise credential-phishing is a theft technique used after an attacker already has a foothold in an environment. Instead of sending a separate fake login page, the attacker abuses a trusted-looking authentication flow to trick a user into entering a password or other secret. Because the prompt appears inside a normal sign-in journey, it can look legitimate even to cautious users.
This matters because it turns identity infrastructure into part of the attack path. In cloud environments, a compromised admin account, a malicious authentication method, or a manipulated policy can be used to present a real-looking prompt and capture credentials before the session completes. Defenders should treat unusual authentication method changes, unexpected sign-in prompts, and policy edits as high-risk events. Monitoring privileged roles, restricting who can alter authentication settings, and verifying that sign-in workflows match approved designs are key controls.