The Rise of Synthetic Passwords in Botnet & Attack Operations

The talk introduces synthetic passwords as an emerging attacker tactic: credentials that are algorithmically generated, have never appeared in a leak, and are built at scale with scripts or AI to look human-like or to carry high entropy. The speaker argues that the goal is often not to get into accounts but to flood security operations with noise and mask credential stuffing, exploiting the assumption that a clean breach-database lookup means low risk.

The speaker showed a simple script that combines names, numbers and special characters to produce unique passwords that look realistic. In a comparison, most passwords taken from recent stealer logs appeared in a breach corpus, while none of the synthetic passwords did. The speaker explained how this weakens breach correlation, makes honeyword traps harder to trigger, and removes behavioural signals such as a single source or a repeated password pattern. Audience questions clarified that the approach works as a mix of brute forcing existing accounts and overwhelming the login service.

For defenders, the speaker recommended not relying on breach correlation alone. Suggested measures included entropy scoring, login pattern anomaly checks, session fingerprinting, and watching for failures that look too clean or sudden surges of highly varied inputs. The talk also proposed shifting detection from identity toward user intent and flagging non-human session patterns. The main takeaway is that a password missing from breach databases should not be treated as safe.