Systems and methods for controlling access to credentials

A system for controlling access to credentials, the system comprising:

• a maintenance module, stored in memory, that maintains, by a computing device, a set of legitimate applications with verified digital certificates that are determined to be widely used based on being installed on a required minimum number of other computing devices, wherein:
• each legitimate application in the set of legitimate applications is selected based on determining that attempting to access digital credentials comprises anomalous behavior for the legitimate application by determining that the legitimate application does not display a historical behavior pattern of attempting to access digital credentials;
• and
• applications that do not meet a required minimum number of installations on the other computing devices are excluded from the set of legitimate applications;
• a monitoring module, stored in memory, that monitors, by the computing device, each legitimate application within the set of legitimate applications for attempts to access digital credentials;
• a detection module, stored in memory, that automatically detects, while monitoring behaviors of each legitimate application in the set of legitimate applications, an attempt of a potentially compromised legitimate application in the set of legitimate applications to access a digital credential;
• a performance module, stored in memory, that performs, in response to detecting the attempt to access the digital credential, a security action to secure the digital credential against unauthorized access by the potentially compromised legitimate application by blocking the attempt to access the digital credential, wherein performing the security action comprises at least one of:
• sending an application update suggestion to a user of the computing device;
• and
• automatically updating the potentially compromised legitimate application to patch a vulnerability;
• and
• at least one processor that executes the maintenance module, the monitoring module, the detection module, and the performance module.

A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

• maintain, by the computing device, a set of legitimate applications with verified digital certificates that are determined to be widely used based on being installed on a required minimum number of other computing devices, wherein:
• each legitimate application in the set of legitimate applications is selected based on determining that attempting to access digital credentials comprises anomalous behavior for the legitimate application by determining that the legitimate application does not display a historical behavior pattern of attempting to access digital credentials;
• and
• applications that do not meet a required minimum number of installations on the other computing devices are excluded from the set of legitimate applications;
• monitor, by the computing device, each legitimate application within the set of legitimate applications for attempts to access digital credentials;
• automatically detect, while monitoring behaviors of each legitimate application in the set of legitimate applications, an attempt of a potentially compromised legitimate application in the set of legitimate applications to access a digital credential;
• and
• perform, in response to detecting the attempt to access the digital credential, a security action to secure the digital credential against unauthorized access by the potentially compromised legitimate application by blocking the attempt to access the digital credential, wherein performing the security action comprises at least one of:
• sending an application update suggestion to a user of the computing device;
• and
• automatically updating the potentially compromised legitimate application to patch a vulnerability.