Hackers steal passwords through eight main tactics: Phishing, password reuse exploitation, malware, brute-force attacks, dictionary attacks, man-in-the-middle data intercepts, unsafe password sharing, and shoulder surfing.
Passwords are the keys that protect financial accounts, company secrets, and other valuable data. This has made passwords a prime target for hackers with bad intentions, but how do hackers get passwords?
How do hackers steal passwords?
If there was only one tactic being used, it might be easier to guard against password theft. Unfortunately, cybercriminals have developed a wide variety of methods.
#1: Phishing attacks
Social engineering tactics rely on human nature and psychological tendencies to gain unauthorized system access and steal information. Phishing attacks are a common social engineering approach that use bogus emails, texts, or phone calls, appearing to be from legitimate sources, to trick us into providing confidential information like passwords.
How Dashlane counters it: AI Phishing Alerts warn you in real time before you enter stored credentials on a risky site, and autofill won't fire on domains that don't match the saved login.
#2: Password reuse
Globally, it's estimated over half of passwords are reused. Reusing passwords is a dangerous habit that puts multiple accounts at risk. If one is breached, they could all be breached.
How Dashlane counters it: The Password Generator creates a unique password for every account, and the Password Health score flags reused passwords so you can fix them.
#3: Malware
Malicious software, or malware, includes variants like adware, worms, and viruses that interfere with the function of your computer. More dangerous varieties, including ransomware and spyware, can be used to steal money, passwords, and other data.
How Dashlane counters it: Autofill means credentials are never typed for keystroke-logging malware to capture, and Dark Web Monitoring alerts you if stolen credentials surface so you can change them fast.
#4: Brute-force attacks
Brute-force attacks use software to guess at user passwords over and over until a match is found. Rather than stealing or purchasing the password, the hacker obtains it through computer-assisted guesswork made more effective by weak or reused passwords.
How Dashlane counters it: Long, random generated passwords make brute-force guessing statistically impractical, and 2FA blocks access even when a guess succeeds.
#5: Dictionary attacks
A subset of brute-force attacks, dictionary attacks cycle through lists of common password phrases and patterns to improve their odds of success. Rather than generating passwords randomly, a dictionary attack leverages available lists of the most commonly used passwords.
How Dashlane counters it: Generated passwords never appear in any dictionary list, which removes this entire attack class.
#6: Data intercepts (man-in-the-middle attacks)
Using this tactic, a hacker virtually positions themselves between two parties to intercept data traveling between them. MITM attacks can be attempted in areas with unsecured WiFi connections, like airports, cafés, and hotels.
How Dashlane counters it: The built-in VPN encrypts traffic on public Wi-Fi, and vault data is encrypted before it ever leaves your device.
#7: Unsafe password sharing
Sharing passwords with friends, family, and coworkers is almost unavoidable. Password sharing increases vulnerability in two ways: The information can be intercepted when shared through unencrypted methods like text or Slack, and sharing exposes everyone in the group if any one person is impacted by cybercrime.
How Dashlane counters it: Encrypted sharing sends logins and Secure Notes to other Dashlane users without ever exposing them in plain text.
#8: Shoulder surfing
Despite all the high-tech tools developed to steal passwords from parts unknown, old-fashioned physical password theft is still a threat. Shoulder surfing involves stealing confidential information by looking over the target's shoulder. Passwords written on sticky notes or slips of paper are highly vulnerable to this method.
How Dashlane counters it: Autofill means passwords are never typed or written down where they can be observed.
What do cybercriminals do with stolen passwords?
You might assume cybercriminals steal passwords for their personal use, collecting accounts to invade and plunder at their leisure. While this may be true in some cases, an entire industry has evolved for cybercriminals exchanging stolen passwords for money on the dark web.
This segment of the deep web is where cybercriminals can complete illegal transactions while keeping their identities hidden.
How to know if you’ve been hacked
Some dangerous hacking tactics, including spyware, are designed to go unnoticed, allowing the cybercriminals to steal more passwords and other valuable information for a longer period. Other methods have more visible signs you can look for.
These signs include:
- Random pop-ups: Pop-ups from sites that don’t typically generate them are a definite warning sign, especially if they include messages from fake antivirus software companies. When you experience excessive or unusual pop-ups, install an antivirus or anti-malware software package if you don’t already have one, and scan your system right away to detect and quarantine any malicious files.
- Emails or direct messages sent from your account (that you didn’t write): Have friends or family members ever asked you about mysterious links or messages from your email or social media account that you never sent? A cybercriminal may have cracked your account password, then stolen personal and financial information from your archives or sent phishing messages to your contacts.
- Your passwords stop working: A cybercriminal who has stolen your password might change the password to lock you out and grant themselves private access. A mistyped password may get you locked out temporarily after several attempts, but if your password and recovery methods continue to fail, someone else may have seized control.
- Fraudulent transactions: You should always pay close attention to bank statements and other financial records to ensure there have been no unusual or unexplained transactions. Cybercriminals might make small purchases initially to test the waters, so don’t overlook low-dollar transactions if you don’t recall making them. Notify your bank or credit card company and change your password immediately if you notice any suspicious transactions.
- You receive a notification: Financial organizations, employers, and cybersecurity apps will often provide security alerts if your account password has been compromised in a data breach. Even if you experienced no visible signs of hacking, you should always take these alerts seriously by changing impacted passwords and following any other recommendations included with the alert.
- Your information is detected on the dark web: Stolen passwords are often traded for financial gain, so scanning the dark web provides an added layer of protection in cases where the cybercrime went undetected. Dashlane’s Dark Web Monitoring continually scans the dark web for your passwords and personal information and notifies you if they’re detected.
How to prevent bad actors from getting your passwords
Cybercriminals have expanded and improved their password theft techniques, but that doesn’t mean you can’t protect yourself. Apply these basic tools and best practices to minimize the risk of stolen passwords:
Create strong passwords
A strong password is one that is at least 12 characters long and includes a random mix of uppercase letters, lowercase letters, numbers, and special characters. You should avoid using personal information (like your name) in your passwords since this makes them more vulnerable to brute-force or dictionary attacks. You should also avoid reusing passwords since multiple accounts can be compromised if a reused password is stolen.
Use encryption
Encryption, or hiding information in an unrecognizable format, originated in ancient times and is now an invaluable tool for website and password security. Encryption provides strong protection from password theft since hackers are unable to see the unencrypted version of the password without the encryption key. Dashlane password manager utilizes AES-256 encryption, widely accepted as the strongest encryption type available, to protect passwords.
Don’t share passwords insecurely
When you use unencrypted password-sharing methods like email, text messages, or Slack to share passwords, you increase your vulnerability to hacking and password theft. Luckily, there are safer sharing methods available. Dashlane’s encrypted sharing portal can be used to send passwords, files, or Secure Notes to other Dashlane users easily and securely.
Learn how to spot social engineering tactics and unsafe websites
Social engineering tactics can extend well beyond phishing emails to include phone calls, in-person scams, and even deepfake impersonations. Imposing a zero-trust policy helps to compensate for the dangerous combination of technology and our tendency to trust others by ensuring everyone is authenticated, no matter who they are (or claim to be). Security training and a discerning eye are also essential for identifying unsafe websites that increase vulnerability to malware and data intercepts.
Use a VPN on public Wi-Fi networks
Public WiFi networks can be susceptible to data intercepts and spoofing, but there is a reliable way to ensure your safety. Using a virtual private network (VPN) protects your privacy, passwords, and account information by encrypting the data going into or out of your device and routing it through a secure portal. A VPN also masks your IP address so you can browse the internet privately.
Turn on 2FA
2-factor authentication (2FA) uses a second login credential in addition to a password. This is typically a code sent through an app or text message. Enabling 2FA when it’s available negates the impact of many common hacking tactics, since the hacker is unlikely to have both stolen credentials and the user’s device to gain unauthorized access.
Use a password manager
A password manager improves your security posture by encrypting passwords and account details, storing your information in a secure vault, and enabling 2FA for an additional layer of security. Dashlane includes automatic password generation and customizable autofill to improve both security and convenience, eliminating the need to create and remember strong passwords for each account.
How IT teams can prevent password theft across an organization
Every tactic on this list scales when the target is an organization: one phished employee, one reused credential, or one password shared over Slack can open the door to company systems. IT and security teams can counter each vector at the policy level:
- Make unique passwords the default, not a request. Deploying a business password manager with enforced password policies neutralizes reuse, brute-force, and dictionary attacks across the whole workforce at once.
- See compromised credentials before attackers use them. Credential Risk Detection monitors for compromised employee credentials even before every employee is onboarded, and Dark Web Insights shows admins which credentials have appeared in breaches.
- Blunt phishing at the point of entry. AI Phishing Alerts warn employees in real time when they're about to enter credentials on a risky site, catching the attacks that slip past email filters and training.
- Replace unsafe sharing with encrypted sharing. Shared team accounts are a fact of life. Encrypted sharing and role-based access keep them off Slack and sticky notes.
See how security teams manage all of this from one place with the Omnix platform, or start a free business trial.
How Dashlane protects you from data theft
Standard Dashlane features, including a secure password-sharing portal, a Password Health score, and Dark Web Monitoring, help protect you from cybercriminals and password theft.
Dashlane provides a secure, encryption-based cloud storage solution, built on what we call a zero-knowledge architecture. Our technical design ensures only the user, not Dashlane or any third party, can decrypt their vault. Even if Dashlane’s infrastructure is compromised, attackers should not be able to access stored credentials or secrets. The platform combines device-level encryption and cloud secure enclaves to protect data at rest, in transit, and in use.
FAQs: how hackers steal passwords
What's the most common way hackers steal passwords?
Phishing is the most common method. Attackers send convincing fake emails, texts, or calls that trick people into entering credentials on a lookalike site. It works at scale because it targets human trust rather than technical defenses, which is why real-time phishing alerts and phishing-resistant logins like passkeys matter.
What's the difference between credential stuffing and phishing?
Phishing tricks you into handing over your password. Credential stuffing uses passwords already stolen elsewhere, testing them against other accounts in bulk to exploit reuse. Phishing steals the credential, and credential stuffing weaponizes it.
Can hackers steal passwords stored in a password manager?
Not in readable form, provided the password manager uses zero-knowledge architecture. Vault data is encrypted on your device before it reaches any server, and it can't be decrypted without your Master Password, which is never stored or transmitted. A strong, unique Master Password and 2FA on the account keep that protection intact.
How can IT teams prevent password theft at work?
Enforce unique, generated passwords through a business password manager, require 2FA at the policy level, monitor for compromised employee credentials with Credential Risk Detection and Dark Web Insights, and replace insecure sharing with encrypted sharing. Policy-level enforcement matters most because it removes the dependency on individual behavior.
References
- Dashlane, “How to Prevent Ransomware Attacks on Your Devices,” March 2023.
- Dashlane, “10 Bad Password Examples: Avoid These Common Mistakes,” March 2023.
- NIST, “Man-in-the middle attack (MITM),” 2023.
- Dashlane, “What Is Password Sharing & When Should I Use It,” February 2023.
- Dashlane, “What To Do If a Scammer Has Access To Your Email Address,” April 2023.
- Dashlane, “Do You Have These 6 Cybersecurity Basics Down?” June 2022.
- Dashlane, “How Strong Is Your Password & Should You Change It?” August 2022.
- Dashlane, “How Password Reuse Leads to Cybersecurity Vulnerabilities,” May 2023.
- Thales, “A Brief History of Encryption and Cryptography,” May 2023.
- Dashlane, “Best Way to Store Passwords at Home or Work,” September 2022.
- Dashlane, “2-factor authentication (2FA) in Dashlane,” 2023.
- Dashlane, “Build the Case for a Password Manager in 8 Steps,” 2023.
- Dashlane, “11 Cyber Threats To Be Aware of & Defend Against,” April 2023.
Sign up to receive news and updates about Dashlane
