[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f7ub1S04P77V9RB02BQjzmtqGXH0-5u2gWWo4vr_dpww":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":133},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":24,"category":25,"article_tags":29},"fdf0757b-44c5-4175-b43d-0e33276465ec","How Synthetic Identity Fraud is Coming for Machine Identities","how-synthetic-identity-fraud-is-coming-for-machine-identities-b9c865","Most people understand identity theft as an attacker stealing a real person's sensitive information and impersonating them. Synthetic identity fraud is much harder to catch. Instead of stealing a real identity, the attacker manufactures a new one, frankensteining together several real data points with fabricated ones to create a person who doesn't exist. Since no real victim monitors misuse, a","Attackers are adapting synthetic identity fraud techniques traditionally used against humans to target Non-Human Identities (NHIs) and service accounts in enterprise environments. Rather than stealing existing credentials, adversaries fabricate entirely new machine identities blending real environmental attributes with fake ones, allowing them to accumulate permissions undetected. The article outlines three main techniques: rogue service accounts, DCShadow infrastructure impersonation, and shadow credentials injection, exploiting weak governance and the scale of modern NHI management.","Synthetic identity fraud emerging as attack vector against machine identities in enterprise environments.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fhow-synthetic-identity-fraud-is-coming.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEg3CPk7mPjct6TcYwb9c1LBGjEBTkHjIkX-_CqYIrmdg3nJu-Vyjmc2qCT_cZbFEoUNaiIEQafCVxDDD0RZfflUs8LqGu9Ecx0N7Tu3nEzHXUW2nKLefXYKsRHfVtv-TZXw_WDILy6sKkE5kk3ts5cBTaSfq1mReYwo6Fb1ghPkg4Z4bLiNuAP4ehxqFG0\u002Fs1600\u002Fkeeper.jpg","2026-07-23T11:45:00+00:00","2026-07-23T14:00:17.735613+00:00",7,[17,20,22],{"name":18,"type":19},"Non-Human Identities (NHIs)","technology",{"name":21,"type":19},"Active Directory",{"name":23,"type":19},"Service Accounts","2c8f44d4-b56e-47cf-9677-04f22c9ee78d",{"id":24,"icon":26,"name":27,"slug":28},null,"Identity & Access","identity-access",[30,35,40],{"category":31},{"id":32,"icon":26,"name":33,"slug":34},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":36},{"id":37,"icon":26,"name":38,"slug":39},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":41},{"id":42,"icon":26,"name":43,"slug":44},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[],{"controls":48,"vendors":132},[49,78,106],{"slug":50,"name":51,"problem":52,"products":53},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[54,62,70],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"omada","Omada","\u002Fvendor-logos\u002Fomada.png","omada-identity-cloud","Omada Identity Cloud","https:\u002F\u002Fomadaidentity.com\u002Fproducts\u002Fomada-identity-cloud\u002F","Identity governance and administration delivered as a service.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":79,"name":80,"problem":81,"products":82},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[83,90,98],{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":85,"url":88,"description":89},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"slug":107,"name":108,"problem":109,"products":110},"deception","Deception and honeypots","An attacker who gets in quietly can explore the network for weeks before any alarm goes off.",[111,119,127],{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-builder","Defused Builder","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Fbuilder","Runs Defused decoys on your own infrastructure, in the cloud, on premises or both, so the data stays with you. In early access.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":128,"product_name":129,"url":130,"description":131},"shadowplex-advanced-threat-defense","ShadowPlex Advanced Threat Defense","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fadvanced-threat-defense\u002F","Deception that detects lateral movement and insider threats early, using AI to place and tune decoys.",[],{"slug":134,"title":135,"body":136,"framework_refs":137,"framework_notes":150},"synthetic-identity-fraud-pivots-to-machine-identities-and-service-accounts","Synthetic Identity Fraud Pivots to Machine Identities and Service Accounts","Attackers are now applying synthetic identity fraud — long used to fabricate human personas — to Non-Human Identities (NHIs) such as service accounts and machine credentials in enterprise environments. Instead of stealing existing credentials, adversaries construct plausible fake machine identities by blending real environmental attributes with fabricated ones, allowing them to quietly accumulate privileges over time. Weak governance over the sheer volume of NHIs in modern organizations creates blind spots that these techniques exploit. This matters because machine identities often carry elevated, long-lived permissions and are rarely subjected to the same scrutiny as human accounts, making them high-value targets with low detection risk.",[138,139,140,141,142,143,144,145,146,147,148,149],"CIS Control 5 – Account Management","CIS Control 6 – Access Control Management","CIS Control 8 – Audit Log Management","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 AC-6 (Least Privilege)","NIST SP 800-53 AU-6 (Audit Record Review)","NIST SP 800-53 IA-4 (Identifier Management)","NIST Zero Trust Architecture (SP 800-207) – Identity Pillar","MITRE ATT&CK T1136 (Create Account)","MITRE ATT&CK T1207 (Rogue Domain Controller \u002F DCShadow)","MITRE ATT&CK T1556.006 (Modify Authentication Process: Multi-Factor Authentication)","GDPR Article 32 – Security of Processing (where NHIs handle personal data)",{}]