Credential access
Credential access is the attacker objective of obtaining authentication material, such as passwords, tokens, keys, or session cookies, that may enable access to accounts or resources.
The target is not always a password
MITRE’s Credential Access category includes stealing application tokens and session cookies as well as obtaining passwords and other authentication material. Its password-store guidance covers places such as browsers and credential managers.
Credential phishing is one way to obtain a secret through deception. Malware, exposed configuration, or access to stored credentials can provide other routes. The objective describes what the attacker seeks; it does not identify the collection method by itself.
The token and cookie guide explains why these artifacts represent different forms of access. A password reset does not necessarily end every session or revoke every application credential.
Obtaining a secret and using it are separate events
A captured artifact may be expired, revoked, bound to a particular context, or limited to a specific service. Finding it in an exposed file does not establish that someone successfully used it.
The stolen-integration-token article follows application access where human sign-in controls do not answer every question. Identify the credential’s owner, intended resource, permissions, and observed use before describing the impact.
Use the containment review to work through the exposed passwords, sessions, and application grants. Each can require a different response.