Article
Leaked Credentials from Ransomware Groups: Case Insights
How leaked credentials from infostealer logs, breach dumps and combolists feed ransomware, with case insights on Telegram channels and access brokers.
Read more
Attack technique
Input Capture
Input capture is when an attacker records what a user types or enters, to steal passwords or other information.
In short
Input capture is when an attacker records what a user types or enters, to steal passwords or other information. It can happen silently in the background or by tricking the user into typing into a fake prompt or page. MITRE lists four forms: keylogging, GUI input capture, web portal capture and credential API hooking.
- Reconnaissance
- Resource Development
- Initial Access
- Execution
- Persistence
- Privilege Escalation
- Stealth
- Defense Impairment
- Credential Access
- Discovery
- Lateral Movement
- Collection
- Command and Control
- Exfiltration
- Impact
- MITRE IDT1056ATT&CK technique
- Detection4ways to spot itAbnormal process behavior · Access to input devices
- Defences2ways to stop itRely on detection
How it works
People enter credentials in many places, such as login pages, portals and system dialog boxes. Input capture targets those moments.
Some methods are invisible to the user, for example hooking into the system functions that handle credentials. Others rely on deception, such as a fake web portal that looks like a real service.
MITRE lists four sub-techniques: keylogging, GUI input capture, web portal capture and credential API hooking. Keylogging is the most common form, and it can be used when other ways of getting credentials do not work.
MITRE lists four sub-techniques: T1056.001 Keylogging; T1056.002 GUI Input Capture; T1056.003 Web Portal Capture; T1056.004 Credential API Hooking.
A real example
Procedure examples listed by MITRE ATT&CK:
- Chaes has a module that can perform any API hooking it wants.
- FlawedAmmyy can collect mouse events.
- Kobalos has used a compromised SSH client to capture the hostname, port, username and password of SSH connections from the compromised host.
- NPPSPY captures user input in the Winlogon process, which allows it to record logon information in cleartext.
- InvisibleFerret has collected mouse and keyboard events using the pyWinhook library.
Seen in incidents
How to detect
-
Abnormal process behavior
Watch for processes that use the system functions for recording keystrokes or polling input devices in ways that do not fit their role.
-
Access to input devices
On Linux and macOS, look for unexpected programs reading input devices or input services, especially those with no visible window.
-
Fake login pages
Monitor web traffic to suspicious addresses that mimic login pages and receive submitted credentials.
-
Detection strategy MITRE lists
DET0102, Behavioral Detection of Input Capture Across Platforms.
How to defend
-
Accept the limits of prevention
MITRE notes this cannot be easily stopped with preventive controls, because it abuses normal system features.
-
Rely on detection
Put effort into monitoring process behavior and input access, since that is where MITRE points defenders.
Questions
What is input capture?
Input capture is when an attacker records what a user types or enters, to steal passwords or other information. Some methods are invisible to the user, while others rely on deception, such as a fake web portal.
What are the types of input capture?
MITRE lists four sub-techniques: keylogging, GUI input capture, web portal capture and credential API hooking. Keylogging is the most common form, and it can be used when other ways of getting credentials do not work.
How can I detect input capture?
Watch for processes that use system functions for recording keystrokes or polling input devices in ways that do not fit their role. Also monitor web traffic to suspicious addresses that mimic login pages and receive submitted credentials.
Can input capture be prevented?
MITRE notes it cannot be easily stopped with preventive controls, because it abuses normal system features. Defenders should therefore put their effort into monitoring process behavior and access to input devices.
In our research
- Leaked Credentials from Ransomware Groups: Case Insights October 2025
- APT38: From SWIFT Heists to Crypto Fortresses September 2025
- Xeno RAT Technical Analysis June 2024
- Fancy Bear APT Group August 2022
- El Machete APT Group August 2022
- APT39 Threat group
Sources
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.