MITRE ATT&CK Technique
T1056Input Capture
- First Reported
- Aug 6, 2020
- Latest Reported
- Oct 26, 2026
Official Description
Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. [Credential API Hooking](https://attack.mitre.org/techniques/T1056/004)) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. [Web Portal Capture](https://attack.mitre.org/techniques/T1056/003)).
- Tactics
- Collection, Credential Access
- Platforms
- Linux, macOS, Network Devices, Windows
- MITRE Version
- 1.4
- Last Modified
- Oct 24, 2025
Sub-techniques (4)
Reported Context (23)
- The kit hooks Telegram's two-step verification flow to copy the password in readable form before the app hashes it. uCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts
- The operation harvests sensitive information and credentials from victims. North Korean Campaign Tied to 30,000 Compromised Devices and $10.71 Million in Crypto Losses
- Victims are directed to pages designed to capture their account credentials. North Korean-linked recruiters target Rust developers with malicious interview lures
- CHOSEN BRICK can capture audio by switching on the victim's microphone. Agencies Warn of Iranian Spyware Campaign Using Fake MRI Lures to Target Dissidents
- GTG-30006 used a phishing portal and SECOMS64 to capture credentials and perform keylogging. Anthropic Reports Claude Misuse in Cyberattacks, Influence Operations and Surveillance
CVE (5)
Malware (28)
People (11)
Threat Actors (25)
MITRE ATT&CK (105)
Vendors (27)
Products (106)
Tools (17)
Industries (22)
Countries (22)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.