MITRE ATT&CK Technique
T1056.003Web Portal Capture
- First Reported
- Sep 22, 2026
- Latest Reported
- Sep 22, 2026
Official Description
Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service.
This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through [External Remote Services](https://attack.mitre.org/techniques/T1133) and [Valid Accounts](https://attack.mitre.org/techniques/T1078) or as part of the initial compromise by exploitation of the externally facing web service.(Citation: Volexity Virtual Private Keylogging)
This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through [External Remote Services](https://attack.mitre.org/techniques/T1133) and [Valid Accounts](https://attack.mitre.org/techniques/T1078) or as part of the initial compromise by exploitation of the externally facing web service.(Citation: Volexity Virtual Private Keylogging)
- Tactics
- Collection, Credential Access
- Platforms
- Linux, macOS, Windows
- Parent Technique
- T1056 · Input Capture
- MITRE Version
- 1.1
- Last Modified
- May 12, 2026
Reported Context (1)
- The Chameleon credential page collected a victim's password through a counterfeit portal. CSuite Campaign Uses Phishing, M365 Session Theft and Remote-Access Tools Against US and EU Organizations
MITRE ATT&CK (26)
Vendors (8)
Products (10)
Tools (3)
Industries (6)
Countries (6)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.