{
  "family": "yahoopass",
  "sample_count": 2,
  "category": "trojan",
  "description": "Trojan:Win32/Yahoopass (or Trojan-PSW:Win32/Yahoopass) is a specialized, targeted credential stealer designed specifically to harvest Yahoo! account credentials, primarily Yahoo! Messenger and Yahoo! Mail passwords. While highly prevalent in the mid-to-late 2000s when Yahoo! Messenger was dominant, the techniques it employs represent the foundational blueprint for modern, application-specific password stealers (`T1552`).<br><br><b>Understanding Yahoopass (Targeted Credential Stealer)</b><br>To an end-user, the infection is silent. They log into their Yahoo account normally, completely unaware that their credentials have been captured and transmitted to an attacker. For a security analyst, Yahoopass demonstrates how attackers build bespoke tools targeting specific applications, exploiting how those applications store or transmit authentication data.<br><br><b>Execution and Theft Mechanics</b><br>Yahoopass was typically distributed via phishing emails or malicious links sent over instant messaging networks. Upon execution, it does not typically act as a general keylogger. Instead, it specifically targets the Yahoo! application. It searches the Windows Registry and file system for stored, weakly encrypted session tokens or saved passwords (`T1552.001`). If a user types their password, Yahoopass often uses API hooking to intercept the specific login form submission, or it dumps the credentials directly from the application's memory space. The stolen data is then exfiltrated via email (SMTP) or HTTP POST to an attacker-controlled drop zone.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the total compromise of the targeted user account, which can then be used for further phishing or identity theft. Host-based IoCs include EDR alerts for unknown executables accessing Yahoo! application directories or attempting to read specific registry keys associated with saved credentials. Network IoCs involve unauthorized outbound SMTP traffic (sending the stolen logs via email) or HTTP POST requests containing encrypted credential blobs.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1005",
    "T1056.001",
    "T1552.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1552.001",
      "name": "Unsecured Credentials: Credentials In Files (Searching for saved Yahoo session data)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging (Targeted hooking of login forms)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1005",
      "name": "Data from Local System (Staging stolen credentials for exfiltration)",
      "tactic": "Collection"
    }
  ],
  "containment_steps": [
    "Isolate the infected machine and run a full anti-malware scan to remove the Yahoopass executable and any associated hooks.",
    "The victim MUST immediately change their Yahoo! account password from a *different, known-clean device*.",
    "Enable Two-Factor Authentication (2FA/MFA) on the compromised account to render any stolen passwords useless.",
    "Investigate the compromised account for unauthorized activity (e.g., spam emails sent, forwarding rules created, secondary email addresses added)."
  ],
  "what_to_avoid": [
    "Do not attempt to change the password on the infected machine, as the malware will simply capture the new password.",
    "Avoid reusing the compromised password on any other online services, as attackers frequently attempt 'credential stuffing' attacks across multiple platforms."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}