Most people understand identity theft as an attacker stealing a real person’s sensitive information and impersonating them. Synthetic identity fraud is much harder to catch. Instead of stealing a real identity, the attacker manufactures a new one, frankensteining together several real data points with fabricated ones to create a person who doesn’t exist. Since no real victim monitors misuse, a fake identity can silently accumulate permissions and credibility over time before it’s ever detected. This same principle has a largely unexplored parallel with Non-Human Identities (NHIs).
Security teams are spending significant effort to protect NHIs from being stolen. Still, the machine-side equivalent of synthetic identity fraud is rarely discussed: identities that were never legitimately provisioned from the start. Following this approach, an attacker doesn’t hijack an existing service account but instead fabricates one, blending real environmental attributes with fake ones so it appears to belong. As enterprises accumulate NHIs faster than they can track them, a fabricated one may slip into the mix with ease if governance is weak and there’s no human ownership.
What synthetic identity fraud looks like for machine identities
For human beings, synthetic identity fraud is well understood as an identity assembled, not stolen, to pass checks while connecting to no actual person. The same construction works against machine identities, but most organizations focus on stolen NHI credentials rather than fabricated identities. With fabricated machine identities, an attacker doesn’t borrow a real identity but rather creates one that was never supposed to exist. Instead of logging in as a legitimate service account, the attacker registers a new admin-level identity with a similar naming structure, grants it privileges and lets it go unnoticed. Since nothing is hijacked, there’s no compromised user to alert and no suspicious behavior to flag.
What makes these identities convincing is the combination of real and invented attributes. A fabricated NHI inherits its environment’s naming conventions, exists in the correct domain, carries plausible-looking metadata and requests the kinds of permissions other NHIs already hold. To an administrator skimming a directory of tens of thousands of service accounts, it is simply one more routine workload, which is why this is one of the most overlooked NHI risks.
How fabricated machine identities are built
None of the techniques attackers use to create fake machine identities are new. What is new, however, is seeing them as a pattern of inserting a credible-looking but illegitimate identity into an environment predisposed to trust it. In practice, attackers create fabricated machine identities in a few main ways:
- Rogue service account: Instead of compromising an account that already exists, an attacker who has gained access creates a new account that looks like an existing one, with similar-looking attributes and standing access. An account that was never sanctioned yet behaves like one is the purest form of a fabricated machine identity.
- DCShadow: Operating at the infrastructure level, an attacker doesn’t fabricate an account but rather an entire source of authority. Because it depends on domain administrator rights the attacker already holds, it’s a post-compromise move rather than a way in: The attacker temporarily registers a rogue domain controller so malicious changes look like legitimate replication traffic from a trusted peer. Once that impersonated infrastructure is accepted, whatever it pushes inherits the system’s own credibility.
- Shadow credentials: An attacker implants fabricated authentication onto an existing object, injecting attacker-controlled material so the attacker can authenticate as that object at will. Since the identity already exists and looks untouched, this is the subtlest means of proving that an identity has been silently forged.
While the mechanics differ, they all involve an illegitimate identity that the environment has accepted as one of its own. It’s important to separate this from a related idea called the synthetic persona, defined by the NHI Management Group as a fabricated identity built to appear credible to people and used to deceive human users through fake profiles and social engineering tactics. That’s the inverse of a fabricated machine identity, which isn’t a fake human meant to deceive people but a fake machine living inside systems, holding real privileges and answering to no one.
The lack of attention that this machine-side equivalent is getting is what makes it so dangerous. Fabricated machine identities can evade detection built to identify stolen ones because the real owner of a stolen identity may notice a login from an unfamiliar place or receive a dark web alert. Meanwhile, a fabricated identity with no owner will not raise any alarms about suspicious behavior, leaked secrets or anything worth noting. Since NHIs are growing rapidly at a pace outnumbering human users, enterprises may not notice an unmonitored identity as an outlier if it hides and quietly accumulates permissions.
Why agentic AI makes this more timely
Until recently, fabricating a machine identity required an attacker to get into a system, create the fake account and assign its privileges manually. Agentic AI is starting to remove that friction. AI agents already acquire credentials dynamically at runtime, and they are increasingly able to spin up other agents with identities of their own. As machine identity creation becomes an automated background activity, the line between a legitimately created identity and a fabricated one begins to blur.
How to defend against synthetic machine identities
If fabricated identities slip through the cracks, organizations cannot expect to protect themselves by manually spotting each one. Strong governance ensures that fabricated identities cannot blend in, accumulate or persist from the outset.
Assign ownership of every NHI
What lets a fabricated identity survive is the fact that no one knows to monitor it. Every NHI should have a registered human owner, a documented purpose and an expiration date, eliminating the potential for identities to remain permanent by default. A machine identity with an owner ensures someone is held accountable and helps protect the legitimate identities in the process.
Rotate secrets
Several fabrication techniques succeed by injecting shadow credentials into an existing object, where an attacker leaves keys they control in place to authenticate at will. Centralized secrets management with automated rotation severs those paths. Every vaulted, tracked and rotated secret prohibits an injected or fabricated credential from having a long shelf life. Organizations must aim to leave attackers in a position where they’re unable to anchor a fabricated identity’s authentication.
Enforce least privilege
Fabricated identities introduce significant security risks because of what they can reach and the standing access that typical service accounts have. Organizations that enforce least-privilege access and Just-in-Time (JIT) access minimize the impact of fabricated identities across environments. If an identity holds only the permissions it needs for as long as it needs them, then a fabricated one will inherit a small, time-limited window instead of standing access. This limits the damage that any identity, real or fake, can cause, which is why it’s effective against threats organizations may not have even detected.
Continuously verify behavior
A fabricated identity’s main advantage is that it appears legitimate from creation, with correct naming, plausible metadata and the right domain. If trust is established only once during provisioning, organizations will be less likely to notice unusual activity. Continuous verification shifts the basis of trust from credentials at creation to behavior over time, basing it on what the identity actually does and what it accesses. Continuously verifying behavior is how organizations can more easily catch the fake identities that were convincing enough to get in.
Account for the fakes in identity security
Securing identities has meant protecting real ones from being exploited. While rotating leaked credentials and locking down compromised accounts is still important, that assumes every identity in an environment is supposed to be there. Organizations must be able to detect the identities that were never legitimately created but behave as if they’re real. Machine identity security demands that every identity be owned, every secret be short-lived and every behavior be closely monitored – all of which can be done from an identity security platform like KeeperPAM®. By managing ownership, secrets and privileged access, organizations have a better chance of eliminating fabricated identity hiding spots and ensuring nothing can accumulate.
Note: This article was thoughtfully written and contributed for our audience by Ashley D’Andrea, Content Writer at Keeper Security.
