Credential Gathering From Third-Party Software
Summary: Unit 42 details how common third-party programs store user credentials insecurely, walking through WinSCP's reversible byte-complement-and-XOR scheme, Git's plaintext credential store, RDCMan and OpenVPN's DPAPI-protected values, and Chromium and Firefox browser password databases. The article notes that password reuse lets an attacker who recovers one saved password pivot to other, better-protected resources, and that Cortex XDR's Credential Gathering Protection Module, released in Cortex 3.4 for Windows, Linux and MacOS agents, is positioned against these attacks.
Key Takeaway: An attacker with a foothold on one machine can pull a domain password out of a saved WinSCP session and then run tools like BloodHound to map how far that single credential spreads - so every convenience-saved password on an endpoint is a potential path into the rest of the organization.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026