Skip to main content
CPEBuddy
when you change your password, it's already stolen

when you change your password, it's already stolen

Source: YouTube · John Hammond · published Oct 16, 2025 · 18:25

Cybersecurity
No ratings yet Log in to rate
Transcript Available
Description

Stealing passwords every time they change is possible on Windows via password filters, a backdoor technique that works even on modern systems like Windows 11 0:07. This method allows attackers to capture plaintext passwords during changes by installing a malicious DLL and modifying the registry to hook into password change notifications 1:00.

Key Takeaways:
• Password filters allow execution of custom code when passwords change, enabling credential theft 1:40.
• A rogue DLL can be created to log new passwords to a local file in clear text when a password is changed 2:54.
• The technique requires administrator privileges, involves placing the DLL in C:\Windows\System32, and modifying the registry under HKLM\SYSTEM\CurrentControlSet\Control\Lsa 3:01.
• The method has been demonstrated since 2013 and remains effective on modern Windows, including domain controllers 16:34.

This technique is a post-exploitation tool for threat actors seeking to harvest sensitive credentials, highlighting the risks of weak password policies and the importance of proactive credential protection 4:49.

Sources:

  • 0:07 Introduction to password filters and their ability to capture passwords.
  • 1:40 Explanation of how password filters operate and notify on password changes.
  • 2:54 Description of creating and deploying a malicious DLL to log passwords.
  • 3:01 Registry modification and persistence

Generate CPE Credits

Generate a professional CPE document from this video's transcript.

Estimated credit: 0.5 CPE hours

Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.

Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.

CISSP Domain Mapping
Learning Objectives
Self-Assessment Questions
PDF Export Ready

Free account. One generation at a time, with a daily limit.

CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.

Watch on YouTube

Transcript Preview

First 800 characters of the transcript

What if every time you changed your password, your new password was instantly stolen and sent to a hacker? Turns out on your Windows computer, that's pretty easy to do because password filters are a way for organizations to enforce stricter password requirements on Windows accounts than those that are available by default in the Active Directory group policy. And it's pretty well documented. This is a writeup and blog post from Mubix or Rob Fuller titled stealing passwords every time they change. Now granted, this is a very old blog post and very old writeup and very old technique, but it still works on modern Windows. Turns out this password filters functionality basically lets you run any code you want whenever any user changes their password. So, what's to stop you from listening in in …