# The Silent Threat: Countering Fabricated Machine Identities  Most IT security professionals are familiar with the concept of identity theft, where an attacker compromises a real person's sensitive information. However, **synthetic identity fraud** presents a far more elusive challenge. Instead of stealing an existing identity, attackers construct a new one, weaving together legitimate data points with fabricated elements to create a non-existent persona. This tactic is particularly dangerous because, without a real victim monitoring for misuse, a fake identity can silently accrue permissions and credibility over time before detection. This same principle now has a significant, yet largely unexplored, parallel with **Non-Human Identities (NHIs)**. While security teams invest substantial effort in protecting NHIs from being stolen, the machine-side equivalent of synthetic identity fraud—identities never legitimately provisioned—is rarely discussed. In this scenario, an attacker doesn't hijack an existing service account but fabricates one, blending real environmental attributes with fake ones to appear legitimate. As enterprises rapidly accumulate NHIs, a fabricated one can easily slip into the mix, especially with weak governance and a lack of human ownership. ## What Synthetic Identity Fraud Looks Like for Machine Identities For human beings, synthetic identity fraud is understood as an assembled, rather than stolen, identity designed to pass checks without connecting to an actual person. The same construction applies to machine identities, yet most organizations primarily focus on compromised NHI credentials rather than fabricated identities. With fabricated machine identities, an attacker creates an identity that was never meant to exist. Instead of logging in as a legitimate service account, the attacker registers a new, often admin-level, identity with a similar naming structure, grants it privileges, and allows it to go unnoticed. Since nothing is hijacked, there's no compromised user to alert and no suspicious behavior to flag. What makes these identities convincing is their blend of real and invented attributes. A fabricated NHI adheres to its environment's naming conventions, exists within the correct domain, carries plausible metadata, and requests permissions typical of other NHIs. To an administrator reviewing a directory of tens of thousands of service accounts, it appears as just another routine workload, making it one of the most overlooked NHI risks. ## How Fabricated Machine Identities Are Built The techniques attackers employ to create fake machine identities are not new. What is novel is their application as a pattern for inserting a credible-looking but illegitimate identity into an environment prone to trusting it. In practice, attackers create fabricated machine identities through several primary methods: * **Rogue Service Account**: Instead of compromising an existing account, an attacker who has gained initial access creates a new account that *mimics* an existing one, complete with similar attributes and standing access. An unsanctioned account that behaves legitimately is the purest form of a fabricated machine identity. * **DCShadow**: Operating at the infrastructure level, an attacker fabricates not just an account but an entire source of authority. This is a post-compromise move, requiring existing domain administrator rights. The attacker temporarily registers a rogue domain controller, making malicious changes appear as legitimate replication traffic from a trusted peer. Once this impersonated infrastructure is accepted, anything it pushes inherits the system's own credibility. * **Shadow Credentials**: An attacker implants fabricated authentication onto an existing object, injecting attacker-controlled material to authenticate as that object at will. Since the identity already exists and appears untouched, this is a subtle method of silently forging an identity. While the mechanics differ, all these methods involve an illegitimate identity that the environment accepts as its own. This concept is distinct from a **synthetic persona**, defined by the **NHI Management Group** as a fabricated identity designed to appear credible to *people* for social engineering. A fabricated machine identity, conversely, is a fake machine living within systems, holding real privileges, and answering to no one. The lack of attention given to this machine-side equivalent makes it particularly dangerous. Fabricated machine identities can evade detection systems built to identify stolen ones because the real owner of a stolen identity might notice an unfamiliar login or a dark web alert. A fabricated identity, with no owner, will not trigger alarms about suspicious behavior or leaked secrets. As NHIs proliferate faster than human users, enterprises might not detect an unmonitored identity if it quietly accumulates permissions. ### Why Agentic AI Makes This More Timely Historically, fabricating a machine identity required an attacker to manually access a system, create the fake account, and assign privileges. **Agentic AI** is beginning to remove this friction. AI agents already dynamically acquire credentials at runtime and are increasingly capable of spinning up other agents with their own identities. As machine identity creation becomes an automated background activity, the distinction between a legitimately created identity and a fabricated one blurs. ## How to Defend Against Synthetic Machine Identities If fabricated identities slip through the cracks, organizations cannot rely on manually spotting each one. Strong governance is essential to prevent fabricated identities from blending in, accumulating, or persisting from the outset. ### Assign Ownership of Every NHI The survival of a fabricated identity hinges on the fact that no one monitors it. Every NHI should have a registered human owner, a documented purpose, and an expiration date. This eliminates the potential for identities to remain permanent by default. A machine identity with an owner ensures accountability and helps protect legitimate identities in the process. ### Rotate Secrets Several fabrication techniques succeed by injecting shadow credentials into an existing object, allowing an attacker to leave controlled keys in place for future authentication. Centralized secrets management with automated rotation severs these paths. Every vaulted, tracked, and rotated secret prohibits an injected or fabricated credential from having a long shelf life. Organizations must aim to prevent attackers from anchoring a fabricated identity's authentication. ### Enforce Least Privilege Fabricated identities pose significant security risks due to the extensive reach and standing access often granted to typical service accounts. Organizations that enforce **least-privilege access** and **Just-in-Time (JIT) access** minimize the impact of fabricated identities across environments. If an identity holds only the necessary permissions for the duration it needs them, a fabricated one will inherit a small, time-limited window instead of standing access. This limits the damage any identity, real or fake, can cause, making it effective against even undetected threats. ### Continuously Verify Behavior A fabricated identity's primary advantage is its initial appearance of legitimacy, with correct naming, plausible metadata, and the right domain. If trust is established only once during provisioning, organizations are less likely to notice unusual activity. Continuous verification shifts the basis of trust from credentials at creation to behavior over time, evaluating what the identity actually does and accesses. Continuously verifying behavior enables organizations to more easily catch fake identities that were convincing enough to get in. ## Account for the Fakes in Identity Security Historically, securing identities has focused on protecting real ones from exploitation. While rotating leaked credentials and locking down compromised accounts remain crucial, this approach assumes every identity in an environment is legitimate. Organizations must now be capable of detecting identities that were never legitimately created but behave as if they are real. Machine identity security demands that every identity be owned, every secret be short-lived, and every behavior be closely monitored. Identity security platforms like **KeeperPAM®** can facilitate this by managing ownership, secrets, and privileged access, thereby improving an organization's ability to eliminate fabricated identities.