# T1555 Credentials from Password Stores > As of 2026-10-05, T1555 (Credentials from Password Stores) appears in 445 tracked threats, first reported 2026-01-27 and most recently 2026-10-03, with linked actors including TeamPCP, APT38, Lazarus Group; it most often appears alongside T1027 (Obfuscated Files or Information). - **Tracked threats:** 445 (146 critical, 272 high, 23 medium, 1 low) - **First seen:** 2026-01-27 - **Last seen:** 2026-10-03 - **Threat actors:** 126 - **Detection rules:** 224 (counts only; Blue tier and above) ## Key facts - **ID:** T1555 - **Framework:** MITRE ATT&CK - **Tactics:** Credential Access - **Matrix:** Enterprise - **Data as of:** 2026-10-05 - **MITRE:** https://attack.mitre.org/techniques/T1555/ ## Activity timeline T1555 first appeared in tracked threats on 2026-01-27 and was most recently reported on 2026-10-03. The busiest month was 2026-07 with 140 reports, and 445 of the 445 threats were reported in the twelve months to 2026-10. ## How adversaries use it T1555 Credentials from Password Stores is catalogued by MITRE ATT&CK under the Credential Access tactic in the Enterprise matrix. Threadlinqs maps 445 of 2623 tracked threats (17%) to it; by severity that is 146 critical, 272 high, 23 medium, 1 low. Threats that use T1555 most often also use [T1027 Obfuscated Files or Information](https://intel.threadlinqs.com/technique/T1027) (325 threats), [T1005 Data from Local System](https://intel.threadlinqs.com/technique/T1005) (321 threats), [T1059 Command and Scripting Interpreter](https://intel.threadlinqs.com/technique/T1059) (294 threats), [T1082 System Information Discovery](https://intel.threadlinqs.com/technique/T1082) (294 threats), [T1041 Exfiltration Over C2 Channel](https://intel.threadlinqs.com/technique/T1041) (278 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 126 tracked threat actors appear in the threats that use T1555; the most frequent are [TeamPCP](https://intel.threadlinqs.com/actor/TeamPCP) (19), [APT38](https://intel.threadlinqs.com/actor/APT38) (17), [Lazarus Group](https://intel.threadlinqs.com/actor/Lazarus%20Group) (13), [Stardust Chollima](https://intel.threadlinqs.com/actor/Stardust%20Chollima) (12), [Contagious Interview](https://intel.threadlinqs.com/actor/Contagious%20Interview) (11). ## Mitigations MITRE ATT&CK lists 3 mitigations for T1555. - [M1026 Privileged Account Management](https://attack.mitre.org/mitigations/M1026/) - [M1027 Password Policies](https://attack.mitre.org/mitigations/M1027/) - [M1051 Update Software](https://attack.mitre.org/mitigations/M1051/) ## Data sources Telemetry that can reveal T1555, per MITRE ATT&CK. - Cloud Service — Cloud Service Enumeration - Command — Command Execution - File — File Access - Process — OS API Execution, Process Access, Process Creation ## Threat actors using it - [TeamPCP](https://intel.threadlinqs.com/actor/TeamPCP) — 19 - [APT38](https://intel.threadlinqs.com/actor/APT38) — 17 - [Lazarus Group](https://intel.threadlinqs.com/actor/Lazarus%20Group) — 13 - [Stardust Chollima](https://intel.threadlinqs.com/actor/Stardust%20Chollima) — 12 - [Contagious Interview](https://intel.threadlinqs.com/actor/Contagious%20Interview) — 11 - [MuddyWater](https://intel.threadlinqs.com/actor/MuddyWater) — 11 - [Sapphire Sleet](https://intel.threadlinqs.com/actor/Sapphire%20Sleet) — 11 - [WageMole](https://intel.threadlinqs.com/actor/WageMole) — 11 - [Andariel](https://intel.threadlinqs.com/actor/Andariel) — 9 - [Shai-Hulud](https://intel.threadlinqs.com/actor/Shai-Hulud) — 7 - [Contagious Interview - G1052](https://intel.threadlinqs.com/actor/Contagious%20Interview%20-%20G1052) — 6 - [Qilin](https://intel.threadlinqs.com/actor/Qilin) — 6 ## Tracked threats The 30 most recent of 445 tracked threats that use T1555. - [The First 24 Hours of a Ransomware Intrusion: Exfiltration, Credential Theft and Backup Targeting (Akira…](https://intel.threadlinqs.com/threat/TL-2026-2852) — high — 2026-10-03 - [TWEAKOS Stealer: Discord Token Theft and Telegram Account-Takeover Marketplace](https://intel.threadlinqs.com/threat/TL-2026-2715) — medium — 2026-09-27 - [Storm-3168 (JADEPUFFER): Agentic-Driven Destructive Cloud Attacks Against Azure via Compromised Service…](https://intel.threadlinqs.com/threat/TL-2026-2666) — critical — 2026-09-26 - [Phishing campaign targeting Japanese/Korean orgs delivering PureRAT / PureLogs RATs via ZIP archives and…](https://intel.threadlinqs.com/threat/TL-2026-2647) — high — 2026-09-25 - [TokenGrabber: Python-based MaaS Infostealer Builder](https://intel.threadlinqs.com/threat/TL-2026-2643) — high — 2026-09-25 - [Vexy Ransomware Claims Quy Nhon University (Vietnam) — New Group, 50GB Exfiltrated](https://intel.threadlinqs.com/threat/TL-2026-2598) — high — 2026-09-21 - [North Korean WaterPlum (Contagious Interview) Campaign Infects 30,000 Devices, Steals $10.71M in Crypto via…](https://intel.threadlinqs.com/threat/TL-2026-2581) — high — 2026-09-19 - [North Korean WaterPlum (Contagious Interview) Hackers Target IT Professionals with BeaverTail…](https://intel.threadlinqs.com/threat/TL-2026-2577) — high — 2026-09-19 - [France Dark Web Threat Landscape: Ransomware and Hacktivist Activity Surges 4x Over 24 Months](https://intel.threadlinqs.com/threat/TL-2026-2564) — high — 2026-09-18 - [KREMLIN Banking Malware Hijacks Chrome and Edge via Phantom Extension/GhostChrome-X Integrity Bypass to…](https://intel.threadlinqs.com/threat/TL-2026-2525) — high — 2026-09-15 - [Pro-Ukraine 'Hacking Cat' Group Deploys Gorilla RAT, Monkey Ransomware, and Nemo Wiper Against Russian…](https://intel.threadlinqs.com/threat/TL-2026-2515) — high — 2026-09-15 - [Compromised HBO Max Reddit Account Distributes ClickFix Malware in "PasteSwitch" Cross-Platform Malvertising…](https://intel.threadlinqs.com/threat/TL-2026-2506) — high — 2026-09-14 - [Access-Code-Gated Phishing Chain Delivers Vidar Infostealer via DocuSign Impersonation](https://intel.threadlinqs.com/threat/TL-2026-2456) — high — 2026-09-12 - [Platform-Aware Phishing Kits Fingerprint Devices to Deliver OS-Specific RATs and Credential Harvesters](https://intel.threadlinqs.com/threat/TL-2026-2452) — high — 2026-09-11 - [Midnight Blizzard (GTG-20006) Used Claude AI Agents to Automate Malware Evasion, Hijack Hotel Wi-Fi…](https://intel.threadlinqs.com/threat/TL-2026-2446) — high — 2026-09-11 - [LegionLoader Malware Distributed via Fake Cloudflare CAPTCHA Using the ClickFix Technique](https://intel.threadlinqs.com/threat/TL-2026-2441) — medium — 2026-09-11 - [ClickFix Lures Deploy MacSync Stealer to Bypass macOS Security](https://intel.threadlinqs.com/threat/TL-2026-2434) — high — 2026-09-10 - [CVE-2025-25249: Fortinet Heap-Based Buffer Overflow Exploited to Deploy PivotC2 RAT on FortiGate Devices](https://intel.threadlinqs.com/threat/TL-2026-2431) — critical — 2026-09-10 - [Infostealer Logs Expose Replayable AI Session Tokens and API Keys Enabling MFA Bypass](https://intel.threadlinqs.com/threat/TL-2026-2416) — high — 2026-09-09 - [Hyadina Rebrands Beast Ransomware as 'GodDamn' and Uses PoisonX Signed Kernel Driver to Disable Endpoint…](https://intel.threadlinqs.com/threat/TL-2026-2409) — critical — 2026-09-08 - [Microsoft September 2026 Patch Tuesday — 999 CVEs, 3 actively exploited zero-days (CVE-2026-85880…](https://intel.threadlinqs.com/threat/TL-2026-2407) — critical — 2026-09-08 - [REVSTEALER (REF2859): Emerging Windows infostealer with App-Bound encryption bypass, Polygon blockchain C2…](https://intel.threadlinqs.com/threat/TL-2026-2370) — high — 2026-09-07 - [DragonForce Ransomware Attack on RubberMill, Inc. — ~340GB Data Exfiltration Including PII, Credentials, CAD…](https://intel.threadlinqs.com/threat/TL-2026-2364) — critical — 2026-09-06 - [Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication (MikroTrick)](https://intel.threadlinqs.com/threat/TL-2026-2345) — critical — 2026-09-06 - [SonicWall SMA1000 Chained Vulnerabilities (CVE-2026-83548, CVE-2026-83549) Exploited in the Wild](https://intel.threadlinqs.com/threat/TL-2026-2307) — critical — 2026-09-03 - [Open-Source Supply Chain Poisoning Campaigns Drive CrowdStrike Endpoint-Based Package Interception](https://intel.threadlinqs.com/threat/TL-2026-2294) — high — 2026-09-02 - [Sality P2P Botnet Disrupted by Law Enforcement and CrowdStrike via Peer-List Sinkholing](https://intel.threadlinqs.com/threat/TL-2026-2284) — high — 2026-09-01 - [Infostealer Malware (Vidar, LummaC2, StealC, RedLine, Acreed, Atomic Stealer/AMOS) Hijacking Claude AI…](https://intel.threadlinqs.com/threat/TL-2026-2262) — high — 2026-08-31 - [ValleyRAT (Winos 4.0) Backdoor Hides in Signed QN Wallpaper Installer via DLL Sideloading](https://intel.threadlinqs.com/threat/TL-2026-2256) — high — 2026-08-31 - [Infostealer Malware (Vidar, LummaC2, StealC, RedLine, Acreed, Atomic Stealer) Hijacking Claude Login…](https://intel.threadlinqs.com/threat/TL-2026-2255) — medium — 2026-08-31 ## Related CVEs CVEs referenced by the tracked threats that use T1555, most frequent first. - [CVE-2025-55182](https://intel.threadlinqs.com/cve/CVE-2025-55182) - [CVE-2025-33073](https://intel.threadlinqs.com/cve/CVE-2025-33073) - [CVE-2026-15409](https://intel.threadlinqs.com/cve/CVE-2026-15409) - [CVE-2026-15410](https://intel.threadlinqs.com/cve/CVE-2026-15410) - [CVE-2017-7921](https://intel.threadlinqs.com/cve/CVE-2017-7921) - [CVE-2021-29441](https://intel.threadlinqs.com/cve/CVE-2021-29441) - [CVE-2025-3248](https://intel.threadlinqs.com/cve/CVE-2025-3248) - [CVE-2025-8088](https://intel.threadlinqs.com/cve/CVE-2025-8088) - [CVE-2026-35616](https://intel.threadlinqs.com/cve/CVE-2026-35616) - [CVE-2026-45321](https://intel.threadlinqs.com/cve/CVE-2026-45321) - [CVE-2021-44228](https://intel.threadlinqs.com/cve/CVE-2021-44228) - [CVE-2023-27532](https://intel.threadlinqs.com/cve/CVE-2023-27532) - [CVE-2023-27997](https://intel.threadlinqs.com/cve/CVE-2023-27997) - [CVE-2023-32409](https://intel.threadlinqs.com/cve/CVE-2023-32409) - [CVE-2023-32434](https://intel.threadlinqs.com/cve/CVE-2023-32434) - [CVE-2023-38606](https://intel.threadlinqs.com/cve/CVE-2023-38606) - [CVE-2023-43000](https://intel.threadlinqs.com/cve/CVE-2023-43000) - [CVE-2023-46805](https://intel.threadlinqs.com/cve/CVE-2023-46805) - [CVE-2023-6895](https://intel.threadlinqs.com/cve/CVE-2023-6895) - [CVE-2024-21762](https://intel.threadlinqs.com/cve/CVE-2024-21762) - [CVE-2024-21887](https://intel.threadlinqs.com/cve/CVE-2024-21887) - [CVE-2024-23222](https://intel.threadlinqs.com/cve/CVE-2024-23222) - [CVE-2024-40766](https://intel.threadlinqs.com/cve/CVE-2024-40766) - [CVE-2024-53704](https://intel.threadlinqs.com/cve/CVE-2024-53704) - [CVE-2024-55591](https://intel.threadlinqs.com/cve/CVE-2024-55591) - [CVE-2025-14174](https://intel.threadlinqs.com/cve/CVE-2025-14174) - [CVE-2025-29927](https://intel.threadlinqs.com/cve/CVE-2025-29927) - [CVE-2025-32433](https://intel.threadlinqs.com/cve/CVE-2025-32433) - [CVE-2025-43529](https://intel.threadlinqs.com/cve/CVE-2025-43529) - [CVE-2026-0257](https://intel.threadlinqs.com/cve/CVE-2026-0257) ## Detection coverage Threadlinqs maintains 224 detection rules mapped to T1555 (SPL 63, KQL 91, Sigma 70). Rule content is available to Blue tier accounts and above; this page shows counts only. 224 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Sub-techniques - [T1555.001 Keychain](https://intel.threadlinqs.com/technique/T1555.001) — 45 tracked threats - T1555.002 Securityd Memory — 0 tracked threats - [T1555.003 Credentials from Web Browsers](https://intel.threadlinqs.com/technique/T1555.003) — 262 tracked threats - [T1555.004 Windows Credential Manager](https://intel.threadlinqs.com/technique/T1555.004) — 13 tracked threats - [T1555.005 Password Managers](https://intel.threadlinqs.com/technique/T1555.005) — 25 tracked threats - T1555.006 Cloud Secrets Management Stores — 6 tracked threats ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1555 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)