[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1555":3},{"item":4,"lessons":18,"controls":68,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1555","T1555","Credentials from Password Stores",22,"MITRE","**What attackers do.** Attackers search systems for stored passwords in places such as browsers, operating system credential stores, password managers and configuration files, then reuse them. This serves the Credential Access tactic and often fuels lateral movement.\n\n**How to defend.** Use a managed enterprise password manager rather than browser-saved passwords, apply policy to disable browser password storage where appropriate, and protect credential stores with platform security features. Limit local admin rights, which many extraction tools need. Endpoint detection should watch for unusual access to credential store files and APIs.\n\n**Signs to look for.** Look for processes other than the owning application reading browser login databases, keychains or credential vault files, and known credential theft tools or infostealer behaviour. A common gap is not considering personal password stores synchronised to corporate devices.","Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1555\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"xworm-rat-evolves-into-full-surveillance-platform-via-leaked-source-code","XWorm RAT Evolves Into Full Surveillance Platform via Leaked Source Code","2026-10-13T12:21:02.686+00:00",{"slug":25,"title":26,"published_at":27},"ai-powered-malware-uses-multi-model-voting-to-autonomously-execute-attacks","AI-Powered Malware Uses Multi-Model Voting to Autonomously Execute Attacks","2026-09-23T21:21:59.067+00:00",{"slug":29,"title":30,"published_at":31},"fake-software-installers-deploy-edr-killing-malware-and-credential-stealer","Fake Software Installers Deploy EDR-Killing Malware and Credential Stealer","2026-09-21T16:20:23.576+00:00",{"slug":33,"title":34,"published_at":35},"infostealer-malware-hijacks-claude-ai-user-sessions","Infostealer Malware Hijacks Claude AI User Sessions","2026-08-31T22:20:38.387+00:00",{"slug":37,"title":38,"published_at":39},"infostealer-malware-hijacks-claude-sessions-via-stolen-credentials","Infostealer Malware Hijacks Claude Sessions via Stolen Credentials","2026-08-30T16:20:34.359+00:00",{"slug":41,"title":42,"published_at":43},"ai-powered-infostealer-prioritizes-high-value-targets-using-behavioral-profiling","AI-Powered Infostealer Prioritizes High-Value Targets Using Behavioral Profiling","2026-07-24T13:20:19.98+00:00",{"slug":45,"title":46,"published_at":47},"okobot-malware-framework-exploits-user-trust-via-clickfix-and-trojanized-github-repos","OkoBot Malware Framework Exploits User Trust via ClickFix and Trojanized GitHub Repos","2026-07-16T20:20:40.25+00:00",{"slug":49,"title":50,"published_at":51},"notarized-macos-malware-bypasses-gatekeeper-to-steal-credentials","Notarized macOS Malware Bypasses Gatekeeper to Steal Credentials","2026-07-13T18:20:22.275+00:00",{"slug":53,"title":54,"published_at":55},"apt-group-armored-likho-uses-spear-phishing-and-ai-generated-malware-to-target-critical-sectors","APT Group Armored Likho Uses Spear-Phishing and AI-Generated Malware to Target Critical Sectors","2026-07-08T16:21:06.698+00:00",{"slug":57,"title":58,"published_at":59},"busysnake-infostealer-targets-critical-infrastructure-via-armored-likho-group","BusySnake Infostealer Targets Critical Infrastructure via Armored Likho Group","2026-07-06T22:20:26.594+00:00",{"slug":61,"title":62,"published_at":63},"armored-likho-apt-uses-spear-phishing-to-target-critical-infrastructure","Armored Likho APT Uses Spear-Phishing to Target Critical Infrastructure","2026-07-06T16:20:42.237+00:00",{"slug":65,"title":66,"published_at":67},"simplehelp-auth-bypass-exploited-to-deploy-credential-stealing-malware","SimpleHelp Auth Bypass Exploited to Deploy Credential-Stealing Malware","2026-06-30T12:21:16.871+00:00",[69,74,79,84,88,93],{"slug":70,"name":71,"problem":72,"stories":73},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",18,{"slug":75,"name":76,"problem":77,"stories":78},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",6,{"slug":80,"name":81,"problem":82,"stories":83},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",5,{"slug":85,"name":86,"problem":87,"stories":83},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":89,"name":90,"problem":91,"stories":92},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",4,{"slug":94,"name":95,"problem":96,"stories":92},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[98,104,109,115,120,125,130,135],{"family":99,"item":100,"code":101,"title":102,"together":103},"gdpr","32","Article 32","Security of processing",17,{"family":105,"item":106,"code":107,"title":108,"together":103},"nist-800-53","si-3","SI-3","Malicious Code Protection",{"family":110,"item":111,"code":112,"title":113,"together":114},"cis","13","Control 13","Network Monitoring and Defense",14,{"family":110,"item":116,"code":117,"title":118,"together":119},"6","Control 6","Access Control Management",11,{"family":105,"item":121,"code":122,"title":123,"together":124},"ac-2","AC-2","Account Management",10,{"family":126,"item":127,"code":128,"title":129,"together":124},"nist-csf","de-cm","DE.CM-1","Continuous Monitoring",{"family":110,"item":131,"code":132,"title":133,"together":134},"14","Control 14","Security Awareness and Skills Training",9,{"family":110,"item":136,"code":137,"title":138,"together":139},"10","Control 10","Malware Defenses",8]