Threat intelligence / Technique

Input Capture

Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. [Credential API Hooking](https://attack.mitre.org/techniques/T1056/004)) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. [Web Portal Capture](https://attack.mitre.org/techniques/T1056/003)).

Technique

TypeTechnique

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. [Credential API Hooking](https://attack.mitre.org/techniques/T1056/004)) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. [Web Portal Capture](https://attack.mitre.org/techniques/T1056/003)).

18 recorded

Relationships

mapped-to

from Collect Data as Provided by Users

Technique

mapped-to

from Credential Prompt Impersonation

Technique

subtechnique-of

from Credential API Hooking

Technique

subtechnique-of

from GUI Input Capture

Technique

subtechnique-of

from Keylogging

Technique

subtechnique-of

from Web Portal Capture

Technique

uses

from APT39

Group

uses

from APT42

Group

uses

from Chaes

Malware

uses

from FlawedAmmyy

Malware

uses

from InvisibleFerret

Malware

uses

Malware

uses

from Leviathan Australian Intrusions

Campaign

uses

Malware

uses

Malware

uses

Tool

uses

from Storm-1811

Group

uses

from Versa Director Zero Day Exploitation

Campaign

2 external

References

mitre-attack

T1056

Adventures of a Keystroke

http://opensecuritytraining.info/Keylogging_files/The%20Adventures%20of%20a%20Keystroke.pdf