Stealing Computer Passwords on Login

This video demonstrates a technique to steal Windows passwords in clear text by exploiting the MP Notify feature in the Windows login process 0:00.

Key Takeaways:
• The method works by creating a malicious DLL that intercepts password information during the Windows login process 1:30
• Local administrator permissions are required to implement this technique through registry modifications 2:26
• Despite being several years old, this technique still works on modern systems including Windows 11 3:16
• The demo uses code from Gregor's PS Bits repository, specifically the NP PSpy tool that captures credentials 9:28
• This technique has been observed in real attacks, as documented by Huntress in 2022 18:23

This attack highlights how legitimate Windows functionality can be weaponized for credential theft.

Sources:

• 0:00 Introduction to the Windows password theft technique
• 1:30 Creating malicious DLLs to intercept passwords
• 2:26 Requirements for local admin permissions
• 3:16 Technique working on Windows 11
• 9:28 Using NP PSpy tool from Gregor's repository
• 18:23 Real-world attack example from Huntress