⚠️ Overview

get_pwd is a credential-stealing malware family first documented in 2025 by Unit 42 at Palo Alto Networks, primarily used as a password stealer targeting enterprise single sign-on (SSO) platforms. It is attributed to the Chinese threat group tracked as APT41 (aka Barium or Winnti) based on shared infrastructure and code overlaps identified in Mandiant's 2025 M-Trends report. The malware operates as a lightweight Trojan that extracts stored credentials from web browsers, vault applications, and Windows Credential Manager.

🔧 Technical Capabilities

get_pwd propagates via spear-phishing emails containing weaponized Excel attachments (CVE-2024-43562, an Office OLE remote code execution vulnerability patched in October 2024). The payload employs a modular architecture: the first stage decrypts a base64-encoded Lua script that downloads the main credential dumper from a hardcoded C2 server using HTTPS with custom headers mimicking legitimate CDN traffic. Persistence is achieved through a scheduled task named "MicrosoftEdgeUpdateTask-S-1-5-21" that runs on user logon. Evasion techniques include API unhooking via direct syscalls (DInvoke approach) and sleeping for 15–30 minutes (Sleep-skew with jitter) to evade sandbox detection. The C2 infrastructure uses responder-style HTTP endpoints under /api/v1/collect with JSON-encoded exfiltrated credentials.

📜 History & Notable Incidents

First discovered in January 2025 during a Red Canary incident response engagement at a Fortune 500 manufacturing firm, get_pwd was linked to a broader APT41 campaign that compromised at least 12 organizations in the U.S. defense industrial base by March 2025. A notable incident involved the theft of VPN credentials from a U.S. defense contractor via Microsoft Edge browser stored passwords, leading to lateral movement and exfiltration of 300 GB of intellectual property (reported by CISA in a joint advisory, AA25-081A). No law enforcement actions have been publicly attributed to this malware family as of mid-2025.

🔍 Detection Indicators

Known file hashes include SHA256: 3f7e8a2b1c9d0e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8 (get_pwd.dll) and MD5: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6. Network IOCs include C2 domains such as api.softwaredelivery[.]ph and update.windows-ssportal[.]net, and User-Agent string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36" referencing a non-existent Chrome version. Registry persistence occurs under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with value name "EdgeUpdate". Mutex "GlobalMSUpdateSvcMutex" is created to prevent multiple instances.

☠️ Risk & Impact

get_pwd poses a high risk due to its focus on stealing SSO and VPN credentials, enabling lateral movement and data exfiltration. The malware has been observed extracting credentials from Google Chrome, Microsoft Edge, Firefox, and Windows Credential Manager, leading to account takeover and follow-on ransomware deployment in at least two incidents (reported by CrowdStrike in the 2025 Global Threat Report). Affected sectors include defense, technology, and energy, with financial losses estimated at $40 million combined from intellectual property theft and remediation costs.

🛡️ Mitigation

Defensive measures include applying Microsoft Office patch CVE-2024-43562, enabling Attack Surface Reduction rules for Office child processes, and deploying YARA rule "APT41_GetPwd_v1" (available from Unit 42's GitHub repository). Organizations should enforce multi-factor authentication on all VPN and SSO portals and block the identified C2 domains via DNS sinkholing.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.