Procedure examples

Matryoshka is capable of stealing Outlook passwords.

NETWIRE can retrieve passwords from messaging and mail client applications.

OLDBAIT collects credentials from several email clients.

CosmicDuke collects user credentials, including passwords, for various programs including popular instant messaging applications and email clients as well as WLAN keys.

MirrorStealer has the ability to steal credentials from email clients.

A module in Prikormka collects passwords stored in applications installed on the victim.

Mispadu has obtained credentials from mail clients via NirSoft MailPassView.

BeaverTail has collected keys stored for Solana stored in `.config/solana/id.json` and other login details associated with macOS within `/Library/Keychains/login.keychain` or for Linux within `/.local/share/keyrings`.

DarkGate use Nirsoft Network Password Recovery or NetPass tools to steal stored RDP credentials in some malware versions.

KGH_SPY can collect credentials from WINSCP.

RedLine Stealer has obtained credentials from VPN services, FTP clients and Instant Messenger (IM)/Chat clients.

XLoader can collect credentials stored in email clients.

MgBot includes modules for stealing stored credentials from Outlook and Foxmail email client software.

PinchDuke steals credentials from compromised hosts. PinchDuke's credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware (also known as LdPinch). Credentials targeted by PinchDuke include ones associated with many sources such as The Bat!, Yahoo!, Mail.ru, Passport.Net, Google Talk, and Microsoft Outlook.

PLEAD has the ability to steal saved passwords from Microsoft Outlook.

Carberp's passw.plug plugin can gather account information from multiple instant messaging, email, and social media services, as well as FTP, VNC, and VPN clients.

Lokibot has stolen credentials from multiple applications and data sources including Windows OS credentials, email clients, FTP, and SFTP clients.

Manjusaka extracts credentials from the Windows Registry associated with Premiumsoft Navicat, a utility used to facilitate access to various database types.

Agent Tesla has the ability to steal credentials from FTP clients and wireless profiles.

Astaroth uses an external software known as NetPass to recover passwords.

PoshC2 can decrypt passwords stored in the RDCMan configuration file.

Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the credential vault and DPAPI.

LaZagne can obtain credentials from databases, mail, and WiFi across multiple platforms.

Pupy can use Lazagne for harvesting credentials.

QuasarRAT can obtain passwords from common FTP clients.

TeamPCP Cloud Stealer can harvest credentials from cryptocurrency wallets and keystores such as Ethereum keystores, Cardano keys, Solana validator keypairs, Ledger device files, and Anchor deploy keys.