TL;DR: Credential harvesting is the large-scale collection of valid credentials that lets attackers log in as legitimate users. Developer machines are an especially rich source: unlike phishing, the credentials already sit in plaintext on disk, so no one needs to be tricked.
Case in point: credential abuse remains the single most pervasive technique across full breach chains. According to Verizon's 2026 Data Breach Investigations Report, credential abuse appears in 39% of breaches when investigators trace the full attack chain, not only the first step in the process.
Most articles on the topic describe phishing attacks, where a fake login page tricks someone into entering a password. However, there is a second vector that matters more for engineering organizations: Credentials on developer machines.
Said credentials include cloud keys in config files, tokens in shell history, SSH keys, and secrets cached by AI tools. Most of them sit in plain text, and are easy to steal. An attacker who gains access to one of these machines doesn't need to trick anyone. The credentials are there, waiting for them to harvest.
This article is for anyone who wants to learn how credential harvesting works, why developer machines are at risk, how to find the credentials before attackers, and how to catch the harvest as it happens.
