[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1555":3},{"item":4,"lessons":18,"controls":69,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1555","T1555","Credentials from Password Stores",22,"MITRE","**What attackers do.** Attackers search systems for stored passwords in places such as browsers, operating system credential stores, password managers and configuration files, then reuse them. This serves the Credential Access tactic and often fuels lateral movement.\n\n**How to defend.** Use a managed enterprise password manager rather than browser-saved passwords, apply policy to disable browser password storage where appropriate, and protect credential stores with platform security features. Limit local admin rights, which many extraction tools need. Endpoint detection should watch for unusual access to credential store files and APIs.\n\n**Signs to look for.** Look for processes other than the owning application reading browser login databases, keychains or credential vault files, and known credential theft tools or infostealer behaviour. A common gap is not considering personal password stores synchronised to corporate devices.","Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1555\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":19,"list":20},26,[21,25,29,33,37,41,45,49,53,57,61,65],{"slug":22,"title":23,"published_at":24},"fake-gta-6-download-delivers-credential-stealing-malware","Fake GTA 6 Download Delivers Credential-Stealing Malware","2026-11-13T16:22:38.997+00:00",{"slug":26,"title":27,"published_at":28},"stealc-takedown-exposes-millions-of-stolen-credentials-from-everyday-users","StealC Takedown Exposes Millions of Stolen Credentials From Everyday Users","2026-11-12T17:21:32.836+00:00",{"slug":30,"title":31,"published_at":32},"64-million-credentials-stolen-via-malware-kits-targeting-unsuspecting-users","6.4 Million Credentials Stolen via Malware Kits Targeting Unsuspecting Users","2026-11-12T17:20:38.235+00:00",{"slug":34,"title":35,"published_at":36},"6-million-stolen-credentials-recovered-in-global-malware-takedown","6 Million Stolen Credentials Recovered in Global Malware Takedown","2026-11-12T14:22:33.813+00:00",{"slug":38,"title":39,"published_at":40},"xworm-rat-evolves-into-full-surveillance-platform-via-leaked-source-code","XWorm RAT Evolves Into Full Surveillance Platform via Leaked Source Code","2026-10-13T12:21:02.686+00:00",{"slug":42,"title":43,"published_at":44},"ai-powered-malware-uses-multi-model-voting-to-autonomously-execute-attacks","AI-Powered Malware Uses Multi-Model Voting to Autonomously Execute Attacks","2026-09-23T21:21:59.067+00:00",{"slug":46,"title":47,"published_at":48},"fake-software-installers-deploy-edr-killing-malware-and-credential-stealer","Fake Software Installers Deploy EDR-Killing Malware and Credential Stealer","2026-09-21T16:20:23.576+00:00",{"slug":50,"title":51,"published_at":52},"infostealer-malware-hijacks-claude-ai-user-sessions","Infostealer Malware Hijacks Claude AI User Sessions","2026-08-31T22:20:38.387+00:00",{"slug":54,"title":55,"published_at":56},"infostealer-malware-hijacks-claude-sessions-via-stolen-credentials","Infostealer Malware Hijacks Claude Sessions via Stolen Credentials","2026-08-30T16:20:34.359+00:00",{"slug":58,"title":59,"published_at":60},"ai-powered-infostealer-prioritizes-high-value-targets-using-behavioral-profiling","AI-Powered Infostealer Prioritizes High-Value Targets Using Behavioral Profiling","2026-07-24T13:20:19.98+00:00",{"slug":62,"title":63,"published_at":64},"okobot-malware-framework-exploits-user-trust-via-clickfix-and-trojanized-github-repos","OkoBot Malware Framework Exploits User Trust via ClickFix and Trojanized GitHub Repos","2026-07-16T20:20:40.25+00:00",{"slug":66,"title":67,"published_at":68},"notarized-macos-malware-bypasses-gatekeeper-to-steal-credentials","Notarized macOS Malware Bypasses Gatekeeper to Steal Credentials","2026-07-13T18:20:22.275+00:00",[70,75,80,84,88,93],{"slug":71,"name":72,"problem":73,"stories":74},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",21,{"slug":76,"name":77,"problem":78,"stories":79},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",6,{"slug":81,"name":82,"problem":83,"stories":79},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":85,"name":86,"problem":87,"stories":79},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":89,"name":90,"problem":91,"stories":92},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",4,{"slug":94,"name":95,"problem":96,"stories":92},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[98,104,109,115,120,125,130,135],{"family":99,"item":100,"code":101,"title":102,"together":103},"nist-800-53","si-3","SI-3","Malicious Code Protection",17,{"family":105,"item":106,"code":107,"title":108,"together":103},"gdpr","32","Article 32","Security of processing",{"family":110,"item":111,"code":112,"title":113,"together":114},"cis","13","Control 13","Network Monitoring and Defense",14,{"family":110,"item":116,"code":117,"title":118,"together":119},"14","Control 14","Security Awareness and Skills Training",13,{"family":110,"item":121,"code":122,"title":123,"together":124},"6","Control 6","Access Control Management",12,{"family":99,"item":126,"code":127,"title":128,"together":129},"ac-2","AC-2","Account Management",10,{"family":131,"item":132,"code":133,"title":134,"together":129},"nist-csf","de-cm","DE.CM-1","Continuous Monitoring",{"family":110,"item":136,"code":137,"title":138,"together":139},"10","Control 10","Malware Defenses",8]