Input Capture: Web Portal Capture
- ID
- T1056.003
- Tactics
- TA0006 Credential Access, TA0009 Collection
- Sub-technique of
- T1056 Input Capture
- Platforms
- Linux, macOS, Windows
- Data sources
- File Modification, Network Traffic Content, File Creation
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service.
This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through External Remote Services and Valid Accounts or as part of the initial compromise by exploitation of the externally facing web service.[1]
Detection
- DET0480 Detection of Credential Harvesting via Web Portal Modification
Data components: File Modification, Network Traffic Content, File Creation
Mitigations (1)
- M1026 Privileged Account Management
Do not allow administrator accounts that have permissions to modify the Web content of organization login portals to be used for day-to-day operations that may expose them to potential adversaries on unprivileged systems.