Most people understand identity theft as an attacker who steals a person’s real, sensitive information and impersonates them. Synthetic identity fraud is very difficult to catch. Instead of stealing a real identity, an attacker creates a new one, combining several real and fabricated data points to create an identity that doesn’t exist. With no real victim monitoring the abuse, fake identities can quietly accumulate permissions and credibility over time before they are discovered. This same principle has an under-explored parallel with Non-Human Identities (NHIs).
Security teams use a lot of effort to protect NHIs from theft. However, the mechanical side of artificial identity fraud is rarely discussed: an identity that has never been legally granted in the first place. By following this method, the attacker does not steal an existing service account but creates one, combining real and fake environment features to appear as his own. As businesses accumulate NHIs faster than they can keep track of them, innovation can easily slip into the mix if governance is weak and there is no personal ownership.
What artificial identity fraud looks like
For people, fake identity fraud is best understood as an identity forged, not stolen, in order to pass checks while being linked to a real person. The same design works against device identity, but many organizations focus on stolen NHI information rather than the identity created. With forged machine identities, an attacker does not borrow a real identity but creates one that should not exist. Instead of logging in as a legitimate service account, the attacker registers a new administrator-level identity with the same naming structure, assigns it privileges and leaves it undetected. Since nothing is stolen, there is no vulnerable user to alert and no suspicious behavior to raise the alarm.
What makes this identity certain is the combination of real and invented features. An established NHI inherits the design principles of the environment, exists in the right domain, holds transparent metadata and requests the kinds of permissions that other NHIs already have. For a manager juggling a directory of tens of thousands of service accounts, it’s just one routine load, which is why this is one of NHI’s most overlooked risks.
How the ownership of the machines was created
There are no methods that attackers use to create new fake machine identities. What is new, however, is to see it as a pattern of inserting a seemingly reliable but illegitimate identity into an environment prone to trust. Essentially, attackers create fake machine identities in several key ways:
- Rogue service account: Instead of compromising an existing account, an attacker who gained access creates a new account you look as existing, with similar features and static access. An account that is never authorized but behaves like one is a pure form of virtual machine identity.
- DCShadow: It works at the infrastructure level, the attacker does not create an account but establishes the entire source of authority. Because it depends on the domain administrator privileges the attacker already has, it is a post-compromise move rather than a method: The attacker temporarily registers a rogue domain controller so that malicious changes look like duplicate traffic from trusted peers. Once that hacked infrastructure is accepted, anything that pushes it inherits the credibility of the system.
- Shadow verification: An attacker injects authentication into an existing object, injecting key that the attacker controls so that the attacker can authenticate as that object at will. Since the identity is already there and appears to be untouched, this is a subtle way to prove that the identity has been quietly created.
Although the mechanics differ, they all involve illegal identification that nature has accepted as part of itself. It is important to distinguish this from a related concept called a synthetic persona, defined by NHI Management Group as a fictitious identity constructed to appear credible people and has been used to trick human users with fake profiles and social engineering tricks. That is the opposite of an invented machine identity, which is not a fake person meant to deceive people but a fake machine that lives inside the systems, holds real rights and answers to no one.
The lack of attention this mechanical equivalent receives is what makes it so dangerous. A fake device identity can avoid detection built for stolen identities because the original owner of the stolen identity may see a login from an unknown site or receive a dark web warning. Currently, the ownerless fictitious identity will not raise any alarms about suspicious behavior, leaked secrets or anything worth noting. As NHIs are growing at a faster rate than human users, businesses may not see an unmonitored identity as an outsider if they hide and silently accumulate permissions.
Why the agent AI makes this timely
Until recently, creating a machine identity required an attacker to log into the system, create a fake account and manually grant its privileges. Agent AI is starting to remove that conflict. AI agents already acquire information dynamically at runtime, and are increasingly able to associate other agents with their own identities. As machine identity creation becomes an automated background task, the line between formally created and manufactured identities begins to blur.
How to protect against artificial intelligence
When virtual identities fall through the cracks, organizations cannot expect to protect themselves by seeing each other in person. Strong governance ensures that creative ownership cannot merge, accumulate or continue from scratch.
Assign ownership of all NHI
What keeps the fictional identity alive is the fact that no one knows how to monitor it. Every NHI must have a registered individual owner, a written purpose and an expiration date, eliminating the ability for ownership to become permanent automatically. Owned device ownership ensures that someone is accountable and helps protect legal ownership in the process.
Rotate the secrets
Several implementations succeed by injecting shadow credentials into an existing object, where the attacker leaves control keys in place to authenticate at will. Centralized privacy management with automatic rotation separates those methods. Every secret that is embellished, tracked and rotated prevents to ensure the injected or manufactured to have a long shelf life. Organizations should aim to leave attackers in a position where they cannot stop fake identity verification.
Use the small right
Forged identities present significant security risks because of the limited access and static access that regular service accounts have. Organizations that enforce least-privileged access and Just-in-Time (JIT) access reduce the impact of established ownership in all areas. If an identity only holds the permissions it needs for as long as it needs them, then the entity will inherit a small, time-limited window instead of static access. This limits the damage that any identity, real or fake, can cause, and is therefore effective against threats that organizations may not have detected.
Continue to confirm behavior
The main advantage of a fictitious identity is that it is seen as legitimate from the moment of creation, with the right names, tangible metadata and the right background. If trust is established only once during provisioning, organizations will not be able to detect unusual activity. Continuous validation changes the basis of trust from creational validation to behavior over time, based on what you do and what you achieve. Continuously verifying behavior is how organizations can easily catch fake identities that were convincing enough to infiltrate.
Fake account for identity protection
Acquiring identities has meant protecting the original from exploitation. While turning over leaked information and shutting down compromised accounts is still important, that assumes all ownership of the site must be there. Organizations must be able to recognize identities that have never been legally created but behave as if they were real. Device identity security requires that all identities be owned, all privacy be temporary and all behavior closely monitored – all of this can be done from an identity protection platform like KeeperPAM®. By managing identities, secrets and privileged access, organizations have a better chance of removing established identity hideouts and ensuring that nothing can accumulate.
Be careful: This article is well written and contributed to our audience by Ashley D’Andrea, Content Writer at Keeper Security.
