Synthetic identity fraud has a machine-identity version now

Writing for The Hacker News, Keeper Security's Ashley D'Andrea argues that synthetic identity fraud, the practice of assembling a fake person from real and fabricated data points rather than stealing a real one, now has a direct equivalent for non-human identities. Rather than compromise an existing service account, an attacker fabricates a new one that blends real environmental attributes with fake ones so it appears to belong, inheriting plausible naming conventions and metadata. Three techniques carry this out: rogue service accounts built to resemble legitimate ones, DCShadow attacks that impersonate a domain controller to write fraudulent directory objects, and shadow credentials that inject attacker-controlled authentication material onto an existing object. The piece names agentic AI as an accelerant, since automated identity creation increasingly blurs the line between a system provisioning a real service account and an attacker minting a fabricated one.

Why it matters

A stolen credential shows up in an anomaly feed eventually, wrong time zone, wrong device, a login where there shouldn't be one. A fabricated identity that was never legitimate has no baseline to deviate from, which is what makes it hard to catch with behavioral detection alone.

The practical fix isn't more monitoring, it's ownership: every non-human identity needs a named human or team accountable for why it exists, so "who requested this service account and why" is answerable on demand rather than reconstructed after the fact during an incident.

Source: The Hacker News