{
  "family": "ggpass",
  "sample_count": 12,
  "category": "trojan",
  "description": "TrojanSpy:Win32/Ggpass (also related to broader 'Password Stealer' heuristics) is a specialized information-stealing trojan designed explicitly to harvest credentials, session tokens, and autofill data from infected endpoints, with a particular focus on extracting saved passwords from popular web browsers (Chrome, Firefox, Edge, etc.) and email clients.<br><br><b>Understanding Ggpass</b><br>To an infected user, Ggpass operates entirely in the background, leaving no visible trace of its activity. The first sign of infection is usually a compromised online account (e.g., unauthorized access to an email, social media, or banking portal). For a security analyst, Ggpass represents an immediate credential compromise event. It does not wait for the user to type their password (like a keylogger); instead, it actively queries the local databases where browsers securely store passwords.<br><br><b>Execution and Theft Mechanics</b><br>Ggpass is typically distributed via phishing emails or bundled with pirated software (`T1204.002`). Upon execution, it does not usually bother with complex persistence mechanisms, as its goal is a rapid 'smash and grab'. It immediately targets the specific file paths where browsers store credentials (e.g., `%LocalAppData%\\Google\\Chrome\\User Data\\Default\\Login Data`) (`T1555.003`). Because modern browsers encrypt these SQLite databases, Ggpass utilizes native Windows APIs (like `CryptUnprotectData`) to decrypt the passwords locally on the victim's machine, using the victim's own Windows session context (`T1528`). It then packages the stolen credentials, cookies, and system information into a ZIP file and exfiltrates it to a C2 server via HTTP or SMTP (`T1041`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the massive compromise of user credentials, which can quickly lead to lateral movement within an enterprise or personal identity theft. Incident responders should monitor EDR for suspicious processes (especially those running from `%Temp%`) accessing browser user data directories (`Login Data`, `Cookies`) or calling `Crypt32.dll` to utilize DPAPI functions. Network logs will show a sudden, short burst of outbound traffic (often an HTTP POST or FTP upload) immediately after execution.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1555.003",
    "T1528",
    "T1204.002",
    "T1041"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1555.003",
      "name": "Credentials from Password Stores: Credentials from Web Browsers",
      "tactic": "Credential Access"
    },
    {
      "id": "T1528",
      "name": "Steal Application Access Token (Session Cookies)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1041",
      "name": "Exfiltration Over C2 Channel",
      "tactic": "Exfiltration"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Assume all passwords saved in the user's web browsers, as well as active session cookies, have been compromised.",
    "Enforce immediate, enterprise-wide password resets for the affected user, prioritizing email, VPN, and financial accounts.",
    "Instruct the user to immediately log out of all active web sessions to invalidate the stolen session cookies.",
    "Use EDR to track the execution chain and locate the dropped Ggpass executable (usually in a temporary directory) for removal."
  ],
  "what_to_avoid": [
    "Do not assume multi-factor authentication (MFA) will fully protect the user; Ggpass steals active session cookies, which can often bypass MFA requirements.",
    "Avoid delaying password resets; stealers exfiltrate data within seconds of execution."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}