How Synthetic Identity Fraud is Coming for Machine Identities

Summary: Synthetic identity fraud builds a new identity from real and fabricated data points rather than stealing a real person's information, and the article argues the same construction applies to non-human identities that were never legitimately provisioned. Attackers register a new admin-level machine identity with a similar naming structure, correct domain and plausible metadata, grant it privileges, and leave it unmonitored because no real owner exists to notice. Agentic AI is described as removing the manual friction of creating such identities, since AI agents already acquire credentials at runtime and can spin up other agents with identities of their own.
What you should know: Detection built for stolen credentials assumes a real owner who might notice an unfamiliar login or a dark web alert, so a fabricated identity with no owner raises no alarm while it quietly accumulates permissions. With NHIs growing faster than human users, an unowned identity can sit in a directory of tens of thousands of service accounts and never register as an outlier.

Read the original at The Hacker News ↗