Skip to content
Irregularpedia Logo Irregularpedia

Credential Theft

Credential Theft

Section titled “Credential Theft”

Direct theft of credentials — passwords, API tokens, session cookies, SSH keys, OAuth refresh tokens. Distinct from account takeover (which is the outcome) — credential theft is one of several paths to it.

Sub-vectors (planned)

Section titled “Sub-vectors (planned)”
  • Infostealer malware — RedLine, Vidar, Lumma, etc. Dump browser-saved passwords, cookies, crypto wallets in one sweep. The dominant credential-theft vector in 2025–2026.
  • Credential dumps / combo lists — leaked passwords from breached services, used to attack accounts that reuse the same password.
  • Password reuse — attacker has your password from breach A, tries it on services B, C, D.
  • Adversary-in-the-Middle (AitM) — Evilginx, Modlishka, EvilProxy. Reverse-proxy the real login page, capture credentials and live MFA in real time.
  • Keylogger / clipboard hijack — Less common in 2026 but still active on legacy Windows targets.
Section titled “Related”