[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f7ub1S04P77V9RB02BQjzmtqGXH0-5u2gWWo4vr_dpww":3},{"article":4,"iocs":46},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":25,"category":26,"article_tags":30},"fdf0757b-44c5-4175-b43d-0e33276465ec","How Synthetic Identity Fraud is Coming for Machine Identities","how-synthetic-identity-fraud-is-coming-for-machine-identities-b9c865","Most people understand identity theft as an attacker stealing a real person's sensitive information and impersonating them. Synthetic identity fraud is much harder to catch. Instead of stealing a real identity, the attacker manufactures a new one, frankensteining together several real data points with fabricated ones to create a person who doesn't exist. Since no real victim monitors misuse, a","Attackers are adapting synthetic identity fraud techniques traditionally used against humans to target Non-Human Identities (NHIs) and service accounts in enterprise environments. Rather than stealing existing credentials, adversaries fabricate entirely new machine identities blending real environmental attributes with fake ones, allowing them to accumulate permissions undetected. The article outlines three main techniques: rogue service accounts, DCShadow infrastructure impersonation, and shadow credentials injection, exploiting weak governance and the scale of modern NHI management.","Synthetic identity fraud emerging as attack vector against machine identities in enterprise environments.","How Synthetic Identity Fraud is Coming for Machine Identities The Hacker NewsJul 23, 2026Identity Security \u002F Cloud Security Most people understand identity theft as an attacker stealing a real person's sensitive information and impersonating them. Synthetic identity fraud is much harder to catch. Instead of stealing a real identity, the attacker manufactures a new one, frankensteining together several real data points with fabricated ones to create a person who doesn't exist. Since no real victim monitors misuse, a fake identity can silently accumulate permissions and credibility over time before it's ever detected. This same principle has a largely unexplored parallel with Non-Human Identities (NHIs). Security teams are spending significant effort to protect NHIs from being stolen. Still, the machine-side equivalent of synthetic identity fraud is rarely discussed: identities that were never legitimately provisioned from the start. Following this approach, an attacker doesn't hijack an existing service account but instead fabricates one, blending real environmental attributes with fake ones so it appears to belong. As enterprises accumulate NHIs faster than they can track them, a fabricated one may slip into the mix with ease if governance is weak and there's no human ownership. What synthetic identity fraud looks like for machine identities For human beings, synthetic identity fraud is well understood as an identity assembled, not stolen, to pass checks while connecting to no actual person. The same construction works against machine identities, but most organizations focus on stolen NHI credentials rather than fabricated identities. With fabricated machine identities, an attacker doesn't borrow a real identity but rather creates one that was never supposed to exist. Instead of logging in as a legitimate service account, the attacker registers a new admin-level identity with a similar naming structure, grants it privileges and lets it go unnoticed. Since nothing is hijacked, there's no compromised user to alert and no suspicious behavior to flag. What makes these identities convincing is the combination of real and invented attributes. A fabricated NHI inherits its environment's naming conventions, exists in the correct domain, carries plausible-looking metadata and requests the kinds of permissions other NHIs already hold. To an administrator skimming a directory of tens of thousands of service accounts, it is simply one more routine workload, which is why this is one of the most overlooked NHI risks. How fabricated machine identities are built None of the techniques attackers use to create fake machine identities are new. What is new, however, is seeing them as a pattern of inserting a credible-looking but illegitimate identity into an environment predisposed to trust it. In practice, attackers create fabricated machine identities in a few main ways: Rogue service account: Instead of compromising an account that already exists, an attacker who has gained access creates a new account that looks like an existing one, with similar-looking attributes and standing access. An account that was never sanctioned yet behaves like one is the purest form of a fabricated machine identity. DCShadow: Operating at the infrastructure level, an attacker doesn't fabricate an account but rather an entire source of authority. Because it depends on domain administrator rights the attacker already holds, it's a post-compromise move rather than a way in: The attacker temporarily registers a rogue domain controller so malicious changes look like legitimate replication traffic from a trusted peer. Once that impersonated infrastructure is accepted, whatever it pushes inherits the system's own credibility. Shadow credentials: An attacker implants fabricated authentication onto an existing object, injecting attacker-controlled material so the attacker can authenticate as that object at will. Since the identity already exists and looks untouched, this is the subtlest means of proving that an identity has been silently forged. While the mechanics differ, they all involve an illegitimate identity that the environment has accepted as one of its own. It's important to separate this from a related idea called the synthetic persona, defined by the NHI Management Group as a fabricated identity built to appear credible to people and used to deceive human users through fake profiles and social engineering tactics. That's the inverse of a fabricated machine identity, which isn't a fake human meant to deceive people but a fake machine living inside systems, holding real privileges and answering to no one. The lack of attention that this machine-side equivalent is getting is what makes it so dangerous. Fabricated machine identities can evade detection built to identify stolen ones because the real owner of a stolen identity may notice a login from an unfamiliar place or receive a dark web alert. Meanwhile, a fabricated identity with no owner will not raise any alarms about suspicious behavior, leaked secrets or anything worth noting. Since NHIs are growing rapidly at a pace outnumbering human users, enterprises may not notice an unmonitored identity as an outlier if it hides and quietly accumulates permissions. Why agentic AI makes this more timely Until recently, fabricating a machine identity required an attacker to get into a system, create the fake account and assign its privileges manually. Agentic AI is starting to remove that friction. AI agents already acquire credentials dynamically at runtime, and they are increasingly able to spin up other agents with identities of their own. As machine identity creation becomes an automated background activity, the line between a legitimately created identity and a fabricated one begins to blur. How to defend against synthetic machine identities If fabricated identities slip through the cracks, organizations cannot expect to protect themselves by manually spotting each one. Strong governance ensures that fabricated identities cannot blend in, accumulate or persist from the outset. Assign ownership of every NHI What lets a fabricated identity survive is the fact that no one knows to monitor it. Every NHI should have a registered human owner, a documented purpose and an expiration date, eliminating the potential for identities to remain permanent by default. A machine identity with an owner ensures someone is held accountable and helps protect the legitimate identities in the process. Rotate secrets Several fabrication techniques succeed by injecting shadow credentials into an existing object, where an attacker leaves keys they control in place to authenticate at will. Centralized secrets management with automated rotation severs those paths. Every vaulted, tracked and rotated secret prohibits an injected or fabricated credential from having a long shelf life. Organizations must aim to leave attackers in a position where they're unable to anchor a fabricated identity's authentication. Enforce least privilege Fabricated identities introduce significant security risks because of what they can reach and the standing access that typical service accounts have. Organizations that enforce least-privilege access and Just-in-Time (JIT) access minimize the impact of fabricated identities across environments. If an identity holds only the permissions it needs for as long as it needs them, then a fabricated one will inherit a small, time-limited window instead of standing access. This limits the damage that any identity, real or fake, can cause, which is why it's effective against threats organizations may not have even detected. Continuously verify behavior A fabricated identity's main advantage is that it appears legitimate from creation, with correct naming, plausible metadata and the right domain. If trust is established only once during provisioning, organizations will be less likely to notice unusual activity. Continuous verification shifts the ba","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fhow-synthetic-identity-fraud-is-coming.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEg3CPk7mPjct6TcYwb9c1LBGjEBTkHjIkX-_CqYIrmdg3nJu-Vyjmc2qCT_cZbFEoUNaiIEQafCVxDDD0RZfflUs8LqGu9Ecx0N7Tu3nEzHXUW2nKLefXYKsRHfVtv-TZXw_WDILy6sKkE5kk3ts5cBTaSfq1mReYwo6Fb1ghPkg4Z4bLiNuAP4ehxqFG0\u002Fs1600\u002Fkeeper.jpg","2026-07-23T11:45:00+00:00","2026-07-23T14:00:17.735613+00:00",7,[18,21,23],{"name":19,"type":20},"Non-Human Identities (NHIs)","technology",{"name":22,"type":20},"Active Directory",{"name":24,"type":20},"Service Accounts","2c8f44d4-b56e-47cf-9677-04f22c9ee78d",{"id":25,"icon":27,"name":28,"slug":29},null,"Identity & Access","identity-access",[31,36,41],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":37},{"id":38,"icon":27,"name":39,"slug":40},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":42},{"id":43,"icon":27,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[]]