Log in Request a demo

Attack technique

Credentials from Password Stores

Credentials from password stores is when an attacker looks in the places where passwords are saved and takes the logins they find.

In short

Credentials from password stores is when an attacker looks in the places where passwords are saved and takes the logins they find. These places include system password storage, saved browser logins, password managers and cloud secrets vaults. Stolen logins can then be used to move to other systems.

Last updated 8 October 2026

Profile MapTechnique
  1. Reconnaissance
  2. Resource Development
  3. Initial Access
  4. Execution
  5. Persistence
  6. Privilege Escalation
  7. Stealth
  8. Defense Impairment
  9. Credential Access
  10. Discovery
  11. Lateral Movement
  12. Collection
  13. Command and Control
  14. Exfiltration
  15. Impact

Credential Access · Step 9 Of 15 In The Attack Chain

  1. MITRE IDT1555ATT&CK technique
  2. Detection4ways to spot itWatch cloud secrets services · Detection strategy MITRE lists
  3. Defences4ways to stop itKeep software updated

How it works

Passwords are kept in several places, depending on the operating system or the application. Some tools exist just to store passwords so users can manage them more easily, such as password managers and cloud secrets vaults.

An attacker with access to a system or account searches these places for saved credentials and tries to read them.

Once they have working credentials, they can use them to move sideways to other systems and reach restricted information. Legitimate logins can also make the attacker harder to notice.

MITRE lists six sub-techniques, covering keychains, browsers, the Windows Credential Manager, password managers and cloud secrets stores.

MITRE lists six sub-techniques: T1555.001 Keychain; T1555.002 Securityd Memory; T1555.003 Credentials from Web Browsers; T1555.004 Windows Credential Manager; T1555.005 Password Managers; T1555.006 Cloud Secrets Management Stores.

A real example

Procedure examples listed by MITRE ATT&CK:

  • Agent Tesla can steal credentials from FTP clients and wireless profiles.
  • Astaroth uses an external tool named NetPass to recover passwords.
  • Carberp's passw.plug plugin can gather account information from instant messaging, email and social media services, as well as FTP, VNC and VPN clients.
  • CosmicDuke collects user credentials, including passwords for instant messaging applications and email clients, as well as WLAN keys.
  • HEXANE is listed by MITRE ATT&CK as having run cmdkey on victim machines to find stored credentials.

How to detect

  1. Watch access to password stores

    Look for unusual processes reading password storage, such as credential databases, system credential services or browser login data, and for odd access between processes.

  2. Watch keychain and keyring access

    On macOS and Linux, monitor access to keychain and keyring data and unusual use of system utilities that open or dump it.

  3. Watch cloud secrets services

    Look for abnormal listing or bulk retrieval of secrets from cloud secrets management services.

  4. Detection strategy MITRE lists

    DET0430, Detect Credentials Access from Password Stores.

How to defend

  1. Limit who can query password stores

    Only allow the accounts and services that truly need it to query password stores, and give them access only to the secrets they require.

  2. Weigh the risk of storing credentials

    Consider whether saving credentials in password stores and browsers is worth the risk. Use technical controls, policy and user training to keep credentials out of improper places.

  3. Use a separate keychain password

    On macOS the login keychain password can differ from the login password, so an attacker needs to know one more secret.

  4. Keep software updated

    Regular updates lower the chance that a flaw is used to get at stored credentials.

Questions

What is Credentials from Password Stores (T1555)?

It is a technique where an attacker looks in the places where passwords are saved and takes the logins they find. These include system password storage, saved browser logins, password managers and cloud secrets vaults.

Why do attackers target password stores?

Once they have working credentials, attackers can move sideways to other systems and reach restricted information. Legitimate logins can also make the attacker harder to notice.

What sub-techniques does T1555 include?

MITRE lists six sub-techniques, covering keychains, browsers, the Windows Credential Manager, password managers and cloud secrets stores. Each one targets a different place where passwords are kept, so defenders need to watch each of those places.

How can I detect access to password stores?

Look for unusual processes reading password storage, such as credential databases, system credential services or browser login data. Monitor keychain and keyring access on macOS and Linux, and abnormal listing or bulk retrieval of secrets from cloud secrets services.

How do I defend against Credentials from Password Stores?

Only allow the accounts and services that truly need it to query password stores, with access to just the secrets they require. Consider whether saving credentials in browsers is worth the risk, keep software updated, and use training and policy to keep credentials out of improper places.

In our research

  1. How to triage a leaked password alert October 2026
  2. Leaked Credentials from Ransomware Groups: Case Insights October 2025
  3. APT38: From SWIFT Heists to Crypto Fortresses September 2025
  4. Mint Stealer Technical Analysis May 2025
  5. Xehook Stealer Technical Analysis June 2024
  6. Xeno RAT Technical Analysis June 2024

Sources

  1. MITRE ATT&CK T1555: Credentials from Password Stores MITRE
  2. MITRE ATT&CK Credential Access (TA0006) MITRE

Browse the threat library

Keep exploring

Knowledge Hub

Article

How to triage a leaked password alert

Learn how to triage a leaked password alert in five steps: check it is real, find out how it leaked, rate the risk, then…

Read more

Threat group

APT37

MITRE ATT&CK describes APT37, also called ScarCruft, as a North Korean state-sponsored cyber espionage group that has been active since at least 2012. It targets South Korea first, using spearphishing emails with Hangul (HWP) attachments, compromised websites and cloud services for control. No government advisory opened names the group itself.

Read more

Threat group

TeamPCP

The US FBI (July 2026) describes TeamPCP as a cyber criminal group behind large-scale software supply chain compromises of widely used developer and security tools. Australian and US authorities announced arrests and an indictment linked to the group in August 2026, and MITRE ATT&CK describes it as active since at least September 2025.

Read more