LogonStealer: Windows Credential Provider DLL for Stealing Plaintext Passwords via CredProvDataModel Hooks
Summary
Why it matters
- Published
- Collected
📦 Full-Text Content Snapshot
R2 Archive · Full Article PreservedAbuses the Credential Provider COM interface to steal plaintext passwords from logonui.exe via CredProvDataModel.dll hooks.
A Windows credential stealer implemented as a rogue Credential Provider DLL. It loads automatically into logonui.exe via COM registration (bypassing PPL) and hooks CredProvDataModel.dll to capture plaintext passwords at the Windows logon and lock screen.
How It Works
Windows loads all registered Credential Providers into logonui.exe via CoCreateInstance.
On modern Windows 11, the password input does not pass through the classic ICredentialProviderCredential::SetStringValue method. Instead, it flows through a WinRT stack:
Windows.UI.Logon.dll
└── textinputframework.dll
└── CredProvDataModel.dll <- hook point
└── ICredentialProvider (classic COM)
└── winlogon (via WNF)The EditField object inside CredProvDataModel.dll manages the password field. Its put_Value method (vtable slot 7) is called on every keystroke with the accumulated value, and get_Value (slot 6) is called at submit time with the final value. Both are hooked with Microsoft Detours.
Technique
CredProvDataModel EditField Hook: hooks put_Value and get_Value on the WinRT EditField object inside CredProvDataModel.dll. This captures the password in plaintext regardless of which Credential Provider the user selects (password, domain, RDP, etc.).
Functions are resolved by byte pattern scan over the .text section of CredProvDataModel.dll, so no hardcoded RVAs or version pinning are required.
Files and Projects
- LocalCredStealerCP: the main DLL source. This is the compiled Credential Provider that gets loaded into
logonui.exe. - registerCP.bat: installs the CP. Writes the registry keys needed. Needs to run as Administrator. After this, the next logon loads the DLL into
logonui.exe. - unregisterCP.cmd: reverses
registerCP.bat. Deletes the same registry keys so Windows stops loading the DLL on logon. Also needs to run as Administrator.
Deployment
- Replace the DLL path inside
registerCP.bat. - Execute
registerCP.batas Administrator. - Sign out or restart.
- Log in.
- Check
C:\cred_capture.logfor the entered plaintext password.
Proof of Concept
<<>> ATTACH PID=11712
<<>> installing hooks
<<>> credprovdatamodel.dll @ 0x00007FFE30650000
<<>> scanning .text @ 0x00007FFE30651000 size=0x77B45
<<>> put_Value found @ 0x00007FFE3067BD70
<<>> get_Value found @ 0x00007FFE3068ADF0
<<>> hooks OK
[CRED] 2026-10-12 10:07:04
password: 1234📦 Full-Text Markdown Snapshot archived by Phying News · Original source: github.com/S12cybersecurity/LogonStealer
---
id: 9087
canonical_url: "https://phying.com/item/9087"
source_url: "https://github.com/S12cybersecurity/LogonStealer"
source_domain: "github.com"
title: "LogonStealer: Windows Credential Provider DLL for Stealing Plaintext Passwords via CredProvDataModel Hooks"
type: "tool"
severity: "unknown"
cve: null
published_at: "2026-10-12T10:07:04Z"
lang: "en"
---
# LogonStealer: Windows Credential Provider DLL for Stealing Plaintext Passwords via CredProvDataModel Hooks
> **Source**: [github.com/S12cybersecurity/LogonStealer](https://github.com/S12cybersecurity/LogonStealer)
Abuses the Credential Provider COM interface to steal plaintext passwords from `logonui.exe` via `CredProvDataModel.dll` hooks.
A Windows credential stealer implemented as a rogue Credential Provider DLL. It loads automatically into `logonui.exe` via COM registration (bypassing PPL) and hooks `CredProvDataModel.dll` to capture plaintext passwords at the Windows logon and lock screen.
---
## How It Works
Windows loads all registered Credential Providers into `logonui.exe` via `CoCreateInstance`.
On modern Windows 11, the password input does not pass through the classic `ICredentialProviderCredential::SetStringValue` method. Instead, it flows through a WinRT stack:
```
Windows.UI.Logon.dll
└── textinputframework.dll
└── CredProvDataModel.dll <- hook point
└── ICredentialProvider (classic COM)
└── winlogon (via WNF)
```
The `EditField` object inside `CredProvDataModel.dll` manages the password field. Its `put_Value` method (vtable slot 7) is called on every keystroke with the accumulated value, and `get_Value` (slot 6) is called at submit time with the final value. Both are hooked with Microsoft Detours.
## Technique
**CredProvDataModel EditField Hook**: hooks `put_Value` and `get_Value` on the WinRT `EditField` object inside `CredProvDataModel.dll`. This captures the password in plaintext regardless of which Credential Provider the user selects (password, domain, RDP, etc.).
Functions are resolved by **byte pattern scan** over the `.text` section of `CredProvDataModel.dll`, so no hardcoded RVAs or version pinning are required.
## Files and Projects
- **LocalCredStealerCP**: the main DLL source. This is the compiled Credential Provider that gets loaded into `logonui.exe`.
- **registerCP.bat**: installs the CP. Writes the registry keys needed. Needs to run as Administrator. After this, the next logon loads the DLL into `logonui.exe`.
- **unregisterCP.cmd**: reverses `registerCP.bat`. Deletes the same registry keys so Windows stops loading the DLL on logon. Also needs to run as Administrator.
## Deployment
1. Replace the DLL path inside `registerCP.bat`.
2. Execute `registerCP.bat` as Administrator.
3. Sign out or restart.
4. Log in.
5. Check `C:\cred_capture.log` for the entered plaintext password.
## Proof of Concept
```
<<>> ATTACH PID=11712
<<>> installing hooks
<<>> credprovdatamodel.dll @ 0x00007FFE30650000
<<>> scanning .text @ 0x00007FFE30651000 size=0x77B45
<<>> put_Value found @ 0x00007FFE3067BD70
<<>> get_Value found @ 0x00007FFE3068ADF0
<<>> hooks OK
[CRED] 2026-10-12 10:07:04
password: 1234
```
---
> 📦 **Full-Text Markdown Snapshot** archived by [Phying News](https://phying.com/item/9087) · Original source: [github.com/S12cybersecurity/LogonStealer](https://github.com/S12cybersecurity/LogonStealer)