{
  "family": "qqpass",
  "sample_count": 612,
  "category": "infostealer",
  "description": "PWS:Win32/QQPass is a highly specialized Password Stealer (PWS) explicitly engineered to harvest credentials, chat logs, and virtual assets from Tencent QQ, one of the world's most popular instant messaging platforms.<br><br><b>What is QQPass?</b><br>For the victim, QQPass results in the immediate hijacking of their Tencent QQ account, often leading to the theft of virtual currency (Q Coins) and social engineering attacks against their contact list. For threat analysts, QQPass represents a highly targeted, region-specific credential stealer. While global in reach, it is predominantly utilized in Chinese cybercrime ecosystems to compromise high-value gaming and social accounts.<br><br><b>Infection Vectors & Threat Hunting</b><br>QQPass is widely distributed via malicious links within chat applications, peer-to-peer file sharing, and fake game mods or cheats. Upon execution, the malware actively hunts for running instances of the Tencent QQ client. It utilizes sophisticated keylogging, screen scraping, and memory reading techniques to capture the user's password as it is typed into the login prompt. Modern variants also attempt to steal the QQ session tokens stored on disk to bypass two-factor authentication.<br><br><b>Forensic Analysis & Impact</b><br>The primary impact is the loss of account control and potential financial theft. Incident responders should analyze the system for unauthorized DLLs injected into the QQ client process space. Threat hunters will often find dropped configuration files or encrypted log files (<code>.dat</code>) in the <code>%AppData%</code> directory containing the stolen keystrokes. Network logs will reveal outbound SMTP or HTTP POST traffic transmitting the stolen credentials back to the attacker's drop zone.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1555",
    "T1056.001",
    "T1055.001",
    "T1048",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    },
    {
      "id": "T1555",
      "name": "Credentials from Password Stores",
      "tactic": "Credential Access"
    },
    {
      "id": "T1055.001",
      "name": "Process Injection: Dynamic-link Library Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1048",
      "name": "Exfiltration Over Alternative Protocol",
      "tactic": "Exfiltration"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint to prevent the active exfiltration of captured QQ credentials and session tokens.",
    "Assist the user in immediately recovering their Tencent QQ account from a known-clean device and forcing a password reset.",
    "Utilize EDR or memory forensics to locate and terminate the keylogging modules injected into the QQ client or <code>explorer.exe</code>.",
    "Perform a full system sweep to eradicate the dropped QQPass executables and delete any temporary log files containing stolen data."
  ],
  "what_to_avoid": [
    "Do not allow the user to type any passwords or access sensitive portals while the machine is infected, as the keylogger captures all input.",
    "Avoid ignoring the infection as 'just a chat stealer'; compromised accounts are heavily used to pivot and launch spearphishing attacks against corporate contacts."
  ],
  "target_industries": [
    "Financial Services",
    "Retail",
    "Consumers"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}