Credential Theft
0 confirmed incidents.
VERIS: malware:Password dumperMITRE ATT&CK: T1110 (Brute Force)T1187 (Forced Authentication)T1056 (Input Capture)
MITRE ATT&CK technique names and ids on this page are reproduced and distributed with the permission of The MITRE Corporation. © 2015–2026, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
Credential theft covers an attack whose goal is obtaining a valid username and password, or other login secret, rather than exploiting a software flaw. It maps to three MITRE ATT&CK techniques: T1110 (Brute Force), repeatedly guessing or trying known passwords; T1187 (Forced Authentication), tricking a system into automatically authenticating to an attacker-controlled endpoint so the credential material can be captured; and T1056 (Input Capture), logging keystrokes or form input directly on a compromised device. Once a working credential is obtained, the attacker typically logs in as the victim and reaches whatever data that account can see.
No confirmed incidents currently carry this attack-type classification.
Questions and answers
How many confirmed incidents are classified as Credential Theft on Breach Census?
0 confirmed incidents are currently classified as Credential Theft.
Which MITRE ATT&CK techniques does the Credential Theft classification cover?
This classification maps to MITRE ATT&CK techniques T1110 (Brute Force), T1187 (Forced Authentication), T1056 (Input Capture).
What counts as a confirmed incident for the Credential Theft classification?
An incident counts here once it carries the Credential Theft attack-type classification and has reached the confirmed status described on the Methodology page; a bare claim or press report is not enough.