{
  "family": "passview",
  "sample_count": 7,
  "category": "advanced_threat",
  "description": "HackTool:Win32/Passview (or generic **NirSoft Password Recovery Abuse** heuristics) refers to the detection of legitimate, powerful system administration utilities—specifically password recovery tools developed by NirSoft (like WebBrowserPassView, MailPassView, or WirelessKeyView)—that are actively being abused by threat actors or insider threats. While these tools are designed to help IT administrators recover lost passwords, their ability to instantly dump plaintext credentials makes them highly prized weapons during the post-exploitation phase of a cyberattack.<br><br><b>Understanding Passview Abuse</b><br>To an end-user, these tools run completely silently in the background. For a security analyst, the unapproved presence of a Passview utility on a corporate endpoint is a 'code red' credential compromise event. These utilities do not crack passwords; they simply query the local SQLite databases or LSA secrets where Windows and web browsers securely store cached credentials and export them into a neat plaintext `.csv` or `.txt` file.<br><br><b>Execution and Credential Dumping Mechanics</b><br>Attackers drop Passview utilities after they have already gained initial access (`T1105`) and established a foothold on the machine. Because these are standalone, portable executables, they do not require installation. The attacker executes the tool via a command-line script (`T1059.003`), passing arguments to force the tool to run silently (e.g., `/stext`) and output the dumped passwords to a hidden file (`T1555.003`). The tool rapidly extracts saved passwords from Chrome, Firefox, Outlook, and the Windows Wireless Manager (`T1555`). The attacker then exfiltrates the plaintext output file (`T1041`) and deletes the tool to cover their tracks.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the total compromise of all credentials saved on the endpoint, leading to Account Takeover (ATO) and lateral movement across the network. The primary IoC is the execution of known NirSoft binaries (e.g., `WebBrowserPassView.exe`) or their associated MD5/SHA256 hashes, often executed from unusual directories like `%Temp%` or `C:\\PerfLogs`. EDR logs will flag command-line executions containing arguments like `/stext` or `/shtml` associated with these binaries. The sudden creation of plaintext `.txt` files containing account names and passwords in temporary directories is a definitive sign of successful dumping.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1555",
    "T1059.003",
    "T1105",
    "T1555.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1555.003",
      "name": "Credentials from Password Stores: Credentials from Web Browsers (Dumping Chrome/Firefox passwords)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1555",
      "name": "Credentials from Password Stores (Dumping email/wireless keys)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer (Dropping the portable utility)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell (Automating the dump via CLI)",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint; the presence of this tool indicates an attacker already has interactive or remote execution capabilities on the machine.",
    "Assume total credential compromise. Enforce a mandatory, immediate password reset for *every* account saved in the user's browser, email client, and VPN.",
    "Perform a deep forensic review to identify the initial entry vector that allowed the attacker to drop and execute the HackTool.",
    "Implement Application Control (like Windows AppLocker) to explicitly block the execution of known password recovery utilities by non-administrative users."
  ],
  "what_to_avoid": [
    "Do not dismiss the alert as a 'false positive' simply because NirSoft tools are technically legitimate; if IT did not explicitly authorize its use, it is a severe breach.",
    "Avoid closing the incident after simply deleting the tool; the passwords have already been exfiltrated."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}