Yahoopass

Overview

Trojan:Win32/Yahoopass (or Trojan-PSW:Win32/Yahoopass) is a specialized, targeted credential stealer designed specifically to harvest Yahoo! account credentials, primarily Yahoo! Messenger and Yahoo! Mail passwords. While highly prevalent in the mid-to-late 2000s when Yahoo! Messenger was dominant, the techniques it employs represent the foundational blueprint for modern, application-specific password stealers (`T1552`).

Understanding Yahoopass (Targeted Credential Stealer)
To an end-user, the infection is silent. They log into their Yahoo account normally, completely unaware that their credentials have been captured and transmitted to an attacker. For a security analyst, Yahoopass demonstrates how attackers build bespoke tools targeting specific applications, exploiting how those applications store or transmit authentication data.

Execution and Theft Mechanics
Yahoopass was typically distributed via phishing emails or malicious links sent over instant messaging networks. Upon execution, it does not typically act as a general keylogger. Instead, it specifically targets the Yahoo! application. It searches the Windows Registry and file system for stored, weakly encrypted session tokens or saved passwords (`T1552.001`). If a user types their password, Yahoopass often uses API hooking to intercept the specific login form submission, or it dumps the credentials directly from the application's memory space. The stolen data is then exfiltrated via email (SMTP) or HTTP POST to an attacker-controlled drop zone.

Indicators of Compromise & Impact
The primary impact is the total compromise of the targeted user account, which can then be used for further phishing or identity theft. Host-based IoCs include EDR alerts for unknown executables accessing Yahoo! application directories or attempting to read specific registry keys associated with saved credentials. Network IoCs involve unauthorized outbound SMTP traffic (sending the stolen logs via email) or HTTP POST requests containing encrypted credential blobs.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1056.001: Implement Endpoint Detection and Response (EDR) to monitor for suspicious API calls related to keystroke interception. Enforce Multi-Factor Authentication (MFA) to render stolen passwords useless.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_YAHOOPASS_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Yahoopass"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "yahoopass" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Yahoopass (Trojan) Execution & Triage
id: d67a255f-a4ee-53a9-a5b7-51efcbd007c7
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Yahoopass malware family. Detects suspicious execution from temporary user
  directories with hidden window flags and background transfer utilities.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/yahoopass
- https://malware-families-catalog.systemhelpdesk.com/defensive/downloader-dropper-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.trojan
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1005
- attack.t1056_001
- attack.t1552_001
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \cscript.exe
    - \wscript.exe
    CommandLine|contains:
    - AppData\Local\Temp
    - -WindowStyle Hidden
    - /e:jscript
    - bitsadmin /transfer
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: medium

rule MALWARE_WIN_YAHOOPASS_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Yahoopass tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "yahoopass" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate the infected machine and run a full anti-malware scan to remove the Yahoopass executable and any associated hooks.
2. The victim MUST immediately change their Yahoo! account password from a *different, known-clean device*.
3. Enable Two-Factor Authentication (2FA/MFA) on the compromised account to render any stolen passwords useless.
4. Investigate the compromised account for unauthorized activity (e.g., spam emails sent, forwarding rules created, secondary email addresses added).

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not attempt to change the password on the infected machine, as the malware will simply capture the new password.
2. Avoid reusing the compromised password on any other online services, as attackers frequently attempt 'credential stuffing' attacks across multiple platforms.

References & External Analysis

• Search "yahoopass" on VirusTotal (External Analysis)
• Search "yahoopass" on Any.Run (Sandbox Sandbox)
• Search "yahoopass" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Trojan)

Explore other documented threats in the same operational category:

• Mz0A4Gxuisb
• Jaik
• Diztakun
• Fakeinstaller
• Hostspatcher
• Neurevt
• Adanti
• Dumpy

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/yahoopass.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.