Loading story…
Security researchers highlighted multiple Windows credential exposure paths that can hand attackers plaintext passwords without requiring noisy LSASS dumping. Common sources include PowerShell command history stored in ConsoleHost_History.txt, plaintext files and stealer logs, exposed Active Directory attributes, and legacy Group Policy Preferences (GPP) XML files in SYSVOL that may still contain decryptable cpassword values accessible to authenticated domain users.
The reporting also described more persistent credential-harvesting techniques that abuse legitimate Windows authentication components, including malicious Security Support Providers, password filter DLLs, and network provider DLLs to capture credentials during logon or password changes. Defenders were urged to remove vulnerable GPP artifacts, deploy protections such as Microsoft's LAPS, audit systems for exposed secrets and suspicious registry or file changes, and monitor for abuse of PowerShell history and authentication-related components with tools such as Sysmon.
Get the actors, campaigns, and ATT&CK mapping behind it.
6 events from the most recent confirmed update back to the earliest known activity.
Volexity published research describing active exploitation of two zero-day vulnerabilities affecting Ivanti Connect Secure VPN appliances. This is a separate incident from the existing Group Policy Preferences timeline and represents the first documented event for this new story in the provided materials.
Microsoft released security update MS14-025/KB2962486 to address the Group Policy Preferences password problem. The update blocked administrators from creating new password-bearing GPP entries but did not remove existing exposed XML files from SYSVOL.
Chris Campbell published "GPP Password Retrieval with PowerShell" and created early PowerShell code to recover passwords from vulnerable Group Policy Preferences data.
Alexandre Herzog also published documentation describing exploitation of credentials stored in Windows Group Policy Preferences.
Emilien Gauralt wrote about exploiting Windows 2008 Group Policy Preferences, documenting how stored credentials could be abused.
Microsoft acquired DesktopStandard's PolicyMaker in 2006 and later rebranded it as Group Policy Preferences in Windows Server 2008, laying the groundwork for the later GPP password exposure issue.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
7 references tracked. Mallory keeps watching after this page renders.
dfir.ch
Open sourcedfir.ch
Open sourceasec.ahnlab.com
Open sourcenextron-systems.com
Open sourcevolexity.com
Open sourceblog.ecapuano.com
Open sourceadsecurity.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors and malware are continuing to harvest credentials from files, configuration stores, and application artifacts on compromised systems, a technique tracked as **MITRE ATT&CK `T1552.001`**. Common targets include browser password stores, email and chat clients, FTP/VPN/SSH tools, cloud credential files, and infrastructure secrets such as Docker or Kubernetes tokens. MITRE’s mappings show groups including **Fox Kitten** and **FIN13** combining this activity with broader credential theft such as **LSASS** dumping, **NTDS.dit** extraction, registry hive theft, and collection of KeePass databases after gaining access through exploited public-facing applications, VPN appliances, remote services, or default credentials. Defenders are also tracking this behavior in enterprise tools that store access secrets locally. Splunk published a Windows analytic that flags **Security Event ID `4663`** when any process other than `winscp.exe` accesses the WinSCP configuration security folder, which may contain SSH and FTP credentials, passwords, and private key references. The detection is intended to catch possible credential theft, including activity linked to information stealers such as **Phantom Stealer**, and Splunk advises investigators to review the accessing process, its parent process, and related network activity while accounting for benign access from backup or antivirus software.
Jul 13, 2026
Security researchers detailed how attackers abuse Windows access tokens to impersonate users, elevate privileges, and move laterally across enterprise environments. The technique relies on the way Windows ties logon sessions, privileges, and cached credentials to access tokens, allowing an attacker with sufficient local rights to duplicate or impersonate another process token and launch a new process under that security context. One proof-of-concept shows a local administrator enabling **`SeDebugPrivilege`**, opening a privileged process such as **`winlogon.exe`**, duplicating its token, and using **`CreateProcessWithTokenW`** to spawn a process as **SYSTEM**. Additional analysis shows token manipulation extends beyond local privilege escalation into stealthier authentication abuse, including **NETONLY** logons, **Pass-the-Hash**, **Pass-the-Ticket**, and **Overpass-the-Hash**. Researchers said attackers can abuse Windows APIs such as **`LogonUserW`**, **`CreateProcessWithLogonW`**, **`DuplicateTokenEx`**, **`SetThreadToken`**, **`ImpersonateLoggedOnUser`**, and **`LsaCallAuthenticationPackage`** to create new logon sessions or alter authentication behavior without changing the visible local user context. Defenders were advised to watch for artifacts such as **Event ID 4624** with **LogonType 9** and to account for detection gaps where Kerberos ticket operations may occur without direct **LSASS** process access.
Aug 15, 2026
Attackers are increasingly leveraging advanced credential theft techniques to compromise Microsoft-based environments, with a focus on identity-first intrusions and abuse of authentication protocols. Kerberoasting attacks have resurged, exploiting legacy RC4 encryption in Kerberos to crack service account passwords, as seen in the Ascension Health ransomware incident. These attacks are facilitated by weak password policies and the continued use of outdated encryption, allowing threat actors to obtain domain administrator credentials and move laterally within networks. The prevalence of credential-based intrusions is underscored by threat intelligence reports indicating that identity attacks are now the leading entry point for breaches. Simultaneously, authentication coercion attacks are evolving, enabling adversaries to force Windows systems to authenticate to attacker-controlled infrastructure without user interaction. Techniques such as exploiting rarely monitored RPC interfaces and tools like PetitPotam (CVE-2021-36942) have been observed in real-world incidents, targeting critical assets like Domain Controllers. Additionally, threat actors are abusing OAuth consent, device code flow, and service principal credential manipulation to maintain persistent, stealthy access to cloud and SaaS platforms, often pivoting from on-premises exploits to Microsoft 365 environments. Organizations are advised to implement robust monitoring, enforce strong authentication policies, and phase out legacy protocols to mitigate these threats.
Jun 29, 2026