{
  "family": "passview",
  "sample_count": 7,
  "category": "advanced_threat",
  "description": "HackTool:Win32/Passview (or generic **NirSoft Password Recovery Abuse** heuristics) refers to the detection of legitimate, powerful system administration utilities—specifically password recovery tools developed by NirSoft (like WebBrowserPassView, MailPassView, or WirelessKeyView)—that are actively being abused by threat actors or insider threats. While these tools are designed to help IT administrators recover lost passwords, their ability to instantly dump plaintext credentials makes them highly prized weapons during the post-exploitation phase of a cyberattack.<br><br><b>Understanding Passview Abuse</b><br>To an end-user, these tools run completely silently in the background. For a security analyst, the unapproved presence of a Passview utility on a corporate endpoint is a 'code red' credential compromise event. These utilities do not crack passwords; they simply query the local SQLite databases or LSA secrets where Windows and web browsers securely store cached credentials and export them into a neat plaintext `.csv` or `.txt` file.<br><br><b>Execution and Credential Dumping Mechanics</b><br>Attackers drop Passview utilities after they have already gained initial access (`T1105`) and established a foothold on the machine. Because these are standalone, portable executables, they do not require installation. The attacker executes the tool via a command-line script (`T1059.003`), passing arguments to force the tool to run silently (e.g., `/stext`) and output the dumped passwords to a hidden file (`T1555.003`). The tool rapidly extracts saved passwords from Chrome, Firefox, Outlook, and the Windows Wireless Manager (`T1555`). The attacker then exfiltrates the plaintext output file (`T1041`) and deletes the tool to cover their tracks.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the total compromise of all credentials saved on the endpoint, leading to Account Takeover (ATO) and lateral movement across the network. The primary IoC is the execution of known NirSoft binaries (e.g., `WebBrowserPassView.exe`) or their associated MD5/SHA256 hashes, often executed from unusual directories like `%Temp%` or `C:\\PerfLogs`. EDR logs will flag command-line executions containing arguments like `/stext` or `/shtml` associated with these binaries. The sudden creation of plaintext `.txt` files containing account names and passwords in temporary directories is a definitive sign of successful dumping.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Passview and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Passview is classified as a Advanced Threat. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Passview establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Passview typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Passview compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Passview should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What lateral movement and credential access tactics does Passview leverage in enterprise intrusions?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Passview frequently utilizes privileged account harvesting techniques such as LSASS memory dumping, Kerberoasting, and token impersonation to escalate privileges. Once administrative credentials are acquired, it pivots across the victim network utilizing living-off-the-land binaries (LOLBins) such as WMI, PowerShell remoting, and PsExec, or abuses remote desktop protocols (RDP) to reach critical internal repositories and domain controllers."
      }
    },
    {
      "@type": "Question",
      "name": "How does Passview maintain covert communications and evade perimeter network monitoring?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Passview often relies on multi-stage command and control (C2) architectures utilizing encrypted protocols over standard web ports (HTTPS/443 or DNS tunneling) to blend in with legitimate enterprise network traffic. Many variants incorporate proxy networks, domain fronting, or cloud services (such as Microsoft Graph API, Google Drive, or Telegram) to masquerade C2 channels, bypassing traditional signature-based egress filtering."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1555",
    "T1059.003",
    "T1105",
    "T1555.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1555.003",
      "name": "Credentials from Password Stores: Credentials from Web Browsers (Dumping Chrome/Firefox passwords)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1555",
      "name": "Credentials from Password Stores (Dumping email/wireless keys)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer (Dropping the portable utility)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell (Automating the dump via CLI)",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint; the presence of this tool indicates an attacker already has interactive or remote execution capabilities on the machine.",
    "Assume total credential compromise. Enforce a mandatory, immediate password reset for *every* account saved in the user's browser, email client, and VPN.",
    "Perform a deep forensic review to identify the initial entry vector that allowed the attacker to drop and execute the HackTool.",
    "Implement Application Control (like Windows AppLocker) to explicitly block the execution of known password recovery utilities by non-administrative users."
  ],
  "what_to_avoid": [
    "Do not dismiss the alert as a 'false positive' simply because NirSoft tools are technically legitimate; if IT did not explicitly authorize its use, it is a severe breach.",
    "Avoid closing the incident after simply deleting the tool; the passwords have already been exfiltrated."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}