Yahoopass

Overview

Trojan:Win32/Yahoopass (or Trojan-PSW:Win32/Yahoopass) is a specialized, targeted credential stealer designed specifically to harvest Yahoo! account credentials, primarily Yahoo! Messenger and Yahoo! Mail passwords. While highly prevalent in the mid-to-late 2000s when Yahoo! Messenger was dominant, the techniques it employs represent the foundational blueprint for modern, application-specific password stealers (`T1552`).

Understanding Yahoopass (Targeted Credential Stealer)
To an end-user, the infection is silent. They log into their Yahoo account normally, completely unaware that their credentials have been captured and transmitted to an attacker. For a security analyst, Yahoopass demonstrates how attackers build bespoke tools targeting specific applications, exploiting how those applications store or transmit authentication data.

Execution and Theft Mechanics
Yahoopass was typically distributed via phishing emails or malicious links sent over instant messaging networks. Upon execution, it does not typically act as a general keylogger. Instead, it specifically targets the Yahoo! application. It searches the Windows Registry and file system for stored, weakly encrypted session tokens or saved passwords (`T1552.001`). If a user types their password, Yahoopass often uses API hooking to intercept the specific login form submission, or it dumps the credentials directly from the application's memory space. The stolen data is then exfiltrated via email (SMTP) or HTTP POST to an attacker-controlled drop zone.

Indicators of Compromise & Impact
The primary impact is the total compromise of the targeted user account, which can then be used for further phishing or identity theft. Host-based IoCs include EDR alerts for unknown executables accessing Yahoo! application directories or attempting to read specific registry keys associated with saved credentials. Network IoCs involve unauthorized outbound SMTP traffic (sending the stolen logs via email) or HTTP POST requests containing encrypted credential blobs.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1056.001: Implement Endpoint Detection and Response (EDR) to monitor for suspicious API calls related to keystroke interception. Enforce Multi-Factor Authentication (MFA) to render stolen passwords useless.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_YAHOOPASS {
    meta:
        description = "Detects Yahoopass (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "yahoopass" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Yahoopass Activity
id: e5462719c760b40852efb6a100f37ad9
status: experimental
description: Detects generic indicators of the yahoopass malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*yahoopass*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate the infected machine and run a full anti-malware scan to remove the Yahoopass executable and any associated hooks.
2. The victim MUST immediately change their Yahoo! account password from a *different, known-clean device*.
3. Enable Two-Factor Authentication (2FA/MFA) on the compromised account to render any stolen passwords useless.
4. Investigate the compromised account for unauthorized activity (e.g., spam emails sent, forwarding rules created, secondary email addresses added).

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not attempt to change the password on the infected machine, as the malware will simply capture the new password.
2. Avoid reusing the compromised password on any other online services, as attackers frequently attempt 'credential stuffing' attacks across multiple platforms.

References & External Analysis

• Search "yahoopass" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Ubot
• Zlob
• Admedia
• Cidox
• Jacksbot

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/yahoopass.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.