Credential Stealer

A credential stealer is a tool — sometimes a standalone module of a larger info stealer — that targets stored or in-memory secrets such as Windows LSASS process credentials, browser password stores, SSH keys, Wi-Fi passwords, and cached domain credentials. Once extracted, the secrets enable lateral movement, persistence, business email compromise, and credential stuffing. Mimikatz is the archetypal example, often loaded reflectively into memory. Defences include Credential Guard, LSA protection, strong least-privilege, removing local admin rights, FIDO2 keys instead of passwords, EDR with memory-scraping detections, and detection of suspicious access to credential stores.