[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fYX0iXJ-ABbZ4Nfnwn28CYCN0Eguhw9BqNFJ24gsKcfs":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":52},"99f3ea2b-fdfd-409a-8463-77307ef62a61","synthetic-identity-fraud-pivots-to-machine-identities-and-service-accounts","fdf0757b-44c5-4175-b43d-0e33276465ec","Synthetic Identity Fraud Pivots to Machine Identities and Service Accounts","Attackers are now applying synthetic identity fraud — long used to fabricate human personas — to Non-Human Identities (NHIs) such as service accounts and machine credentials in enterprise environments. Instead of stealing existing credentials, adversaries construct plausible fake machine identities by blending real environmental attributes with fabricated ones, allowing them to quietly accumulate privileges over time. Weak governance over the sheer volume of NHIs in modern organizations creates blind spots that these techniques exploit. This matters because machine identities often carry elevated, long-lived permissions and are rarely subjected to the same scrutiny as human accounts, making them high-value targets with low detection risk.","**Immediate actions:**\n- Audit all service accounts and NHIs to establish a verified, authoritative inventory, flagging any accounts without clear ownership or business justification.\n- Review and restrict permissions on service accounts to enforce least-privilege, removing any excessive or stale entitlements immediately.\n\n**Long-term improvements:**\n- Implement a formal NHI lifecycle management program covering creation, rotation, and decommissioning of all machine identities.\n- Deploy privileged access management (PAM) tooling that enforces just-in-time access and monitors service account activity continuously.\n- Establish directory hygiene controls to detect and block unauthorized domain controller replication events (e.g., DCShadow attacks) and rogue shadow credential injection.\n\n**Detection measures:**\n- Enable detailed logging of service account authentication events, privilege escalations, and directory replication activity, and alert on anomalous patterns.\n- Integrate NHI telemetry into your SIEM to correlate machine identity behavior against baselines, triggering investigation when new accounts accumulate permissions rapidly.",[12,13,14,15,16,17,18,19,20,21,22,23],"CIS Control 5 – Account Management","CIS Control 6 – Access Control Management","CIS Control 8 – Audit Log Management","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 AC-6 (Least Privilege)","NIST SP 800-53 AU-6 (Audit Record Review)","NIST SP 800-53 IA-4 (Identifier Management)","NIST Zero Trust Architecture (SP 800-207) – Identity Pillar","MITRE ATT&CK T1136 (Create Account)","MITRE ATT&CK T1207 (Rogue Domain Controller \u002F DCShadow)","MITRE ATT&CK T1556.006 (Modify Authentication Process: Multi-Factor Authentication)","GDPR Article 32 – Security of Processing (where NHIs handle personal data)",{},"published","2026-07-23T14:21:08.491586+00:00","2026-07-23T14:21:08.376+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fhow-synthetic-identity-fraud-is-coming.html","how-synthetic-identity-fraud-is-coming-for-machine-identities-b9c865","How Synthetic Identity Fraud is Coming for Machine Identities",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":40,"name":41,"slug":42,"description":43,"color":44},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":46,"name":47,"slug":48,"description":49,"color":50},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[],[53,57,61],{"slug":54,"name":55,"problem":56},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":58,"name":59,"problem":60},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",{"slug":62,"name":63,"problem":64},"deception","Deception and honeypots","An attacker who gets in quietly can explore the network for weeks before any alarm goes off."]