Procedure examples

Evilnum can collect email credentials from victims.

MuddyWater has performed credential dumping with LaZagne and other tools, including by dumping passwords saved in victim email.

FIN6 has used the Stealer One credential stealer to target e-mail and file transfer utilities including FTP.

Leafminer used several tools for retrieving login and password information, including LaZagne.

APT39 has used the Smartftp Password Decryptor tool to decrypt FTP passwords.

OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.

Stealth Falcon malware gathers passwords from multiple sources, including Windows Credential Vault and Outlook.

Malteiro has obtained credentials from mail clients via NirSoft MailPassView.

HEXANE has run `cmdkey` on victim machines to identify stored credentials.

APT33 has used a variety of publicly available tools like LaZagne to gather credentials.

Matryoshka is capable of stealing Outlook passwords.

NETWIRE can retrieve passwords from messaging and mail client applications.

OLDBAIT collects credentials from several email clients.

CosmicDuke collects user credentials, including passwords, for various programs including popular instant messaging applications and email clients as well as WLAN keys.

MirrorStealer has the ability to steal credentials from email clients.

A module in Prikormka collects passwords stored in applications installed on the victim.

Mispadu has obtained credentials from mail clients via NirSoft MailPassView.

BeaverTail has collected keys stored for Solana stored in `.config/solana/id.json` and other login details associated with macOS within `/Library/Keychains/login.keychain` or for Linux within `/.local/share/keyrings`.

DarkGate use Nirsoft Network Password Recovery or NetPass tools to steal stored RDP credentials in some malware versions.

KGH_SPY can collect credentials from WINSCP.

RedLine Stealer has obtained credentials from VPN services, FTP clients and Instant Messenger (IM)/Chat clients.

XLoader can collect credentials stored in email clients.

MgBot includes modules for stealing stored credentials from Outlook and Foxmail email client software.

PinchDuke steals credentials from compromised hosts. PinchDuke's credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware (also known as LdPinch). Credentials targeted by PinchDuke include ones associated with many sources such as The Bat!, Yahoo!, Mail.ru, Passport.Net, Google Talk, and Microsoft Outlook.

PLEAD has the ability to steal saved passwords from Microsoft Outlook.

Carberp's passw.plug plugin can gather account information from multiple instant messaging, email, and social media services, as well as FTP, VNC, and VPN clients.

Lokibot has stolen credentials from multiple applications and data sources including Windows OS credentials, email clients, FTP, and SFTP clients.

Manjusaka extracts credentials from the Windows Registry associated with Premiumsoft Navicat, a utility used to facilitate access to various database types.

Agent Tesla has the ability to steal credentials from FTP clients and wireless profiles.

Astaroth uses an external software known as NetPass to recover passwords.

PoshC2 can decrypt passwords stored in the RDCMan configuration file.

Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the credential vault and DPAPI.

LaZagne can obtain credentials from databases, mail, and WiFi across multiple platforms.

Pupy can use Lazagne for harvesting credentials.

QuasarRAT can obtain passwords from common FTP clients.

TeamPCP Cloud Stealer can harvest credentials from cryptocurrency wallets and keystores such as Ethereum keystores, Cardano keys, Solana validator keypairs, Ledger device files, and Anchor deploy keys.

Contagious Interview has leveraged malware variants configured to dump credentials from the macOS keychain.

iKitten collects the keychains on the system.

Cuckoo Stealer can capture files from a targeted user's keychain directory.

Green Lambert can use Keychain Services API functions to find and collect passwords, such as `SecKeychainFindInternetPassword` and `SecKeychainItemCopyAttributesAndData`.

LightSpy performs an in-memory keychain query via `SecItemCopyMatching()` then formats the retrieved data as a JSON blob for exfiltration.

BeaverTail has collected keys associated with macOS within `/Library/Keychains/login.keychain`.

GlassWorm has collected keys stored within `/Library/Keychains/login.keychain-db`.

Calisto collects Keychain storage data and copies those passwords/tokens to a file.

MacMa can dump credentials from the macOS keychain.

Proton gathers credentials in files for keychains.

Empire uses the command `/usr/bin/security dump-keychain -d` to read the keychain credential.

LaZagne can obtain credentials from macOS Keychains.

Keydnap uses the keychaindump project to read securityd memory.

During Juicy Mix, OilRig used the CDumper (Chrome browser) and EDumper (Edge browser) to collect credentials.