Procedure examples

Zebrocy has the capability to upload dumper tools that extract credentials from web browsers and store them in database files.

Unknown Logger is capable of stealing usernames and passwords from browsers on the victim machine.

PinchDuke steals credentials from compromised hosts. PinchDuke's credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware (also known as LdPinch). Credentials targeted by PinchDuke include ones associated with many sources such as Netscape Navigator, Mozilla Firefox, Mozilla Thunderbird, and Internet Explorer.

PLEAD can harvest saved credentials from browsers such as Google Chrome, Microsoft Internet Explorer, and Mozilla Firefox.

Raccoon Stealer collects passwords, cookies, and autocomplete information from various popular web browsers.

Carberp's passw.plug plugin can gather passwords saved in Opera, Internet Explorer, Safari, Firefox, and Chrome.

Proton gathers credentials for Google Chrome.

Lokibot has demonstrated the ability to steal credentials from multiple applications and data sources including Safari and the Chromium and Mozilla Firefox-based web browsers.

PoetRAT has used a Python tool named Browdec.exe to steal browser credentials.

Melcoz has the ability to steal credentials from web browsers.

njRAT has a module that steals passwords saved in victim web browsers.

ChChes steals credentials stored inside Internet Explorer.

Manjusaka gathers credentials from Chromium-based browsers.

Agent Tesla can gather credentials from a number of browsers.

QakBot has collected usernames and passwords from Firefox and Chrome.

CookieMiner can steal saved usernames and passwords in Chrome as well as credit card credentials.

jRAT can capture passwords from common web browsers such as Internet Explorer, Google Chrome, and Firefox.

Lizar has a module to collect usernames and passwords stored in browsers.

H1N1 dumps usernames and passwords from Firefox, Internet Explorer, and Outlook.

Azorult can steal credentials from the victim's browser.

WarzoneRAT has the capability to grab passwords from numerous web browsers as well as from Outlook and Thunderbird email clients.

SILENTTRINITY can collect clear text web credentials for Internet Explorer/Edge.

Empire can use modules that extract passwords from common web browsers such as Firefox and Chrome.

Imminent Monitor has a PasswordRecoveryPacket module for recovering browser passwords.

Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from DPAPI.

LaZagne can obtain credentials from web browsers such as Google Chrome, Internet Explorer, and Firefox.

Pupy can use Lazagne for harvesting credentials.

QuasarRAT can obtain passwords from common web browsers.

RainyDay can use the QuarksPwDump tool to obtain local passwords and domain cached credentials.

ROKRAT can steal credentials by leveraging the Windows Vault mechanism.

KGH_SPY can collect credentials from the Windows Credential Manager.

Valak can use a .NET compiled module named exchgrabber to enumerate credentials from the Credential Manager.

Lizar has a plugin that can retrieve credentials from Internet Explorer and Microsoft Edge using `vaultcmd.exe` and another that can collect RDP access credentials using the `CredEnumerateW` function.

SILENTTRINITY can gather Windows Vault credentials.

PowerSploit contains a collection of Exfiltration modules that can harvest credentials from Windows vault credential objects.

Mimikatz contains functionality to acquire credentials from the Windows Credential Manager.

LaZagne can obtain credentials from Vault files.

TrickBot can steal passwords from the KeePass open source password manager.

InvisibleFerret has utilized the command `ssh_zcp` to exfiltrate data from browser extensions and password managers via Telegram and FTP.

MarkiRAT can gather information from the Keepass password manager.

Proton gathers credentials in files for 1password.

Mini Shai-Hulud has gathered credentials stored in password managers to include password vaults.

Shai-Hulud has gathered secrets from AWS Secrets and GCP Secret Manager. Shai-Hulud has also gathered data from Azure Key Vault.

Pacu can retrieve secrets from the AWS Secrets Manager via the enum_secrets module.

TruffleHog can obtain secrets from AWS Secrets and GCP Secret Manager. TruffleHog has also gathered passwords, secrets and API keys from source repositories, .env files, and git history.

TeamPCP Cloud Stealer can enumerate multiple filesystem paths to extract credentials for AWS, GCP, and Azure including Identity Access Management (IAM) credentials.

Mini Shai-Hulud has captured credentials stored in cloud secret stores.

CanisterWorm has gathered credentials from Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure.

Kessel has trojanized the <sode>ssh_login</code> and user-auth_pubkey functions to steal plaintext credentials.

Ebury can intercept private keys using a trojanized ssh-add function.