Loading malware…
NPPSPY is a credential-stealing malware/tool that abuses the Windows Network Provider mechanism to capture cleartext logon credentials. It registers a malicious Network Provider listener in the Registry, including use of the misspelled label "logincontroll" under HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order, and modifies the Registry so output from the Winlogon process is redirected from legitimate listening DLLs to the malicious provider. This allows NPPSPY to capture user input into Winlogon and record logon information in cleartext, with collected data automatically written to a specified file on the victim machine. The technique is described as stealing cleartext credentials by abusing Network Providers, and a 2020 implementation was published by researcher Grzegorz Tworek on GitHub under the name NPPSpy. Supporting content also associates NPPSPY with intrusion activity and broader toolkits, including reporting that Check Point Research observed GoldenSMTP intrusions targeting governments in Central Asia using phishing with password-protected ZIPs, DLL hijacking, and tools including the NPPSPY credential stealer.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
8 distinct techniques documented for this family, organized by ATT&CK tactic.
The content references collection of credential material from local systems, including "Bumblebee can capture and compress stolen credentials from the Registry and volume shadow copies," "GALLIUM collected ... password hashes from the SAM hive in the Registry," and "Windigo has used a script to gather credentials in files left on disk by OpenSSH backdoors."
The content repeatedly describes threat actors and malware collecting, stealing, identifying, copying, or staging files, documents, credentials, logs, databases, and other information from compromised hosts or local systems.
NPPSPY records data entered from the local system logon at Winlogon to capture credentials in cleartext.
Agrius used a custom tool, sql.net4.exe, to query SQL databases and then identify and extract personally identifiable information... AppleSeed has automatically collected data from USB drives, keystrokes, and screen images before exfiltration... Ember Bear engages in mass collection from compromised systems during intrusions.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Credential theft tool referenced in the context of Atomic Red Team-style testing for OS credential dumping detections.
Malware that creates a network listener and establishes persistence via a modified NetworkProvider Order registry key using the label 'logincontroll'.
Credential-stealing malware used to harvest credentials during intrusions.
Credential-stealing tool used as part of the GoldenSMTP/IndigoZebra-related toolkit.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.