PSA: Beware of Windows PowerShell Credential Request Prompts

[steven36]

A new PowerShell script was posted on Github recently that prompts a victim to enter their login credentials, checks if they are correct, and then sends the credentials to a remote server. This allows an attacker to distribute the script and harvest domain login credentials from their victims.

 

 

 

Description on Github

This Github script utilizes the Get-Credential PowerShell cmdlet to display the login prompt that asks the user to enter their credentials. When the user enters their credentials, the script will try to use them to authenticate to the victim's domain, and if successful, will send the credentials to a remote server. If the entered credentials are incorrect, the script will keep prompting the user to enter their credentials.

At this point the only way to terminate the prompt, is to open Task Manager, look for a process called "Windows PowerShell", and then terminate it.

 

 

Task Manager

Thankfully, the login prompt displayed by this particular script makes it easy to spot as the alert will be titled "Windows PowerShell credential request" and will contain a blue ribbon with a set of keys as shown below.

 

Default Get-credentials Prompt

 

 

The problem is that the the title of this alert can be changed by using a slightly different PowerShell cmdlet, which we will not be sharing here.  By using the different command, an attacker can further customize the login prompt to make it more convincing to the victim. 

 

For example, below we created a prompt that pretends to be Windows Defender and asks the user to login in order to clean the computer.

 

 

While experienced computer users may still find prompt to be suspicious, there are many who may think it's legitimate and enter the login name and password.

 

Thankfully, even though the title may have been changed, the prompt itself still contains the blue ribbon with the set of keys in it. Therefore, if you ever see a prompt asking for your username and password and the alert look similar to the one above, be wary about entering your credentials. It very well could be an attempt to steal your domain login.

 

Source