{
  "family": "passcv",
  "sample_count": 1,
  "category": "trojan",
  "description": "<h3>Executive Summary</h3>\nPassCV is a highly specialized credential stealer designed to extract stored passwords, autocomplete data, and sensitive session tokens from compromised Windows environments. It primarily targets web browsers, email clients, and FTP applications, acting as an automated data harvesting tool for threat actors.\n\n<h3>Infection Vector and Extraction Methodology</h3>\nPassCV is often deployed as a secondary payload, dropped by an initial access broker or a generic downloader trojan following a successful phishing campaign. It is engineered for rapid execution; its goal is to extract data and exfiltrate it before the victim or security tools can respond.\n\nUpon execution, PassCV scans the host system for installed applications known to store credentials locally. It targets the underlying SQLite databases and encrypted credential stores of popular web browsers (Google Chrome, Mozilla Firefox, Microsoft Edge), email clients (Microsoft Outlook, Thunderbird), and FTP clients (FileZilla). \n\nPassCV utilizes native Windows APIs (such as `CryptUnprotectData` within the DPAPI - Data Protection API framework) to decrypt the stored passwords locally. The harvested data—which includes URLs, usernames, passwords, and occasionally credit card numbers—is aggregated into a single file, compressed, and exfiltrated to a command-and-control (C2) server via HTTP POST requests.\n\n<h3>Security and Privacy Implications</h3>\nA PassCV infection is a critical security incident that often precedes lateral movement or data breaches. The rapid theft of browser-stored credentials provides attackers with immediate, authenticated access to corporate web applications, cloud infrastructure (e.g., AWS, Azure), and internal portals.\n\n<h3>Incident Response and Mitigation</h3>\n<ul>\n<li><strong>Credential Invalidation:</strong> Immediate, organization-wide password resets are mandatory following a confirmed PassCV infection. All active session tokens must be forcibly revoked.</li>\n<li><strong>Policy Enforcement:</strong> Implement Group Policy Objects (GPOs) to explicitly disable the built-in password management and autofill features within corporate web browsers.</li>\n<li><strong>Behavioral Monitoring:</strong> Configure EDR solutions to monitor for anomalous access to browser profile directories (`%LocalAppData%\\Google\\Chrome\\User Data`) and the unauthorized use of DPAPI functions by non-system processes.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Trojan.PassCV",
    "PasswordStealer.PassCV",
    "Win32/PassCV"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1555.003",
    "T1003",
    "T1048",
    "T1552.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T16:03:45Z",
  "type": "Credential Stealer",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}