How Synthetic Identity Fraud is Coming for Machine Identities

What Synthetic Identity Fraud Looks Like for Machine Identities

Most people understand identity theft as an attacker stealing a real person's sensitive information and impersonating them. Synthetic identity fraud is much harder to catch. Instead of stealing a real identity, the attacker manufactures a new one, frankensteining together several real data points with fabricated ones to create a person who doesn't exist. Since no real victim monitors misuse, a fake identity can silently accumulate permissions and credibility over time before it's ever detected.

This same principle has a largely unexplored parallel with Non-Human Identities (NHIs). Security teams are spending significant effort to protect NHIs from being stolen. Still, the machine-side equivalent of synthetic identity fraud is rarely discussed: identities that were never legitimately provisioned from the start.

Following this approach, an attacker doesn't hijack an existing service account but instead fabricates one, blending real environmental attributes with fake ones so it appears to belong. As enterprises accumulate NHIs faster than they can track them, a fabricated one may slip into the mix with ease if governance is weak and there's no human ownership.

What Makes These Identities Convincing

What makes these identities convincing is the combination of real and invented attributes. A fabricated NHI inherits its environment's naming conventions, exists in the correct domain, carries plausible-looking metadata and requests the kinds of permissions other NHIs already hold. To an administrator skimming a directory of tens of thousands of service accounts, it is simply one more routine workload, which is why this is one of the most overlooked NHI risks.

How Fabricated Machine Identities Are Built

None of the techniques attackers use to create fake machine identities are new. What is new, however, is seeing them as a pattern of inserting a credible-looking but illegitimate identity into an environment predisposed to trust it. In practice, attackers create fabricated machine identities in a few main ways:

Rogue service account: Instead of compromising an account that already exists, an attacker who has gained access creates a new account that looks like an existing one, with similar-looking attributes and standing access. An account that was never sanctioned yet behaves like one is the purest form of a fabricated machine identity.

DCShadow: Operating at the infrastructure level, an attacker doesn't fabricate an account but rather an entire source of authority. Because it depends on domain administrator rights the attacker already holds, it's a post-compromise move rather than a way in: The attacker temporarily registers a rogue domain controller so malicious changes look like legitimate replication traffic from a trusted peer. Once that impersonated infrastructure is accepted, whatever it pushes inherits the system's own credibility.

Shadow credentials: An attacker implants fabricated authentication onto an existing object, injecting attacker-controlled material so the attacker can authenticate as that object at will. Since the identity already exists and looks untouched, this is the subtlest means of proving that an identity has been silently forged.

Why Agentic AI Makes This More Timely

Until recently, fabricating a machine identity required an attacker to get into a system, create the fake account and assign its privileges manually. Agentic AI is starting to remove that friction. AI agents already acquire credentials dynamically at runtime, and they are increasingly able to spin up other agents with identities of their own. As machine identity creation becomes an automated background activity, the line between a legitimately created identity and a fabricated one begins to blur.

How to Defend Against Synthetic Machine Identities

If fabricated identities slip through the cracks, organizations need to be aware of the risks and take steps to prevent them. This includes implementing strong identity governance, monitoring for suspicious activity, and regularly reviewing and updating identity policies.