---
id: 9087
canonical_url: "https://phying.com/item/9087"
source_url: "https://github.com/S12cybersecurity/LogonStealer"
source_domain: "github.com"
title: "LogonStealer: Windows Credential Provider DLL for Stealing Plaintext Passwords via CredProvDataModel Hooks"
type: "tool"
severity: "unknown"
cve: null
published_at: "2026-10-12T10:07:04Z"
lang: "en"
---

# LogonStealer: Windows Credential Provider DLL for Stealing Plaintext Passwords via CredProvDataModel Hooks

> **Source**: [github.com/S12cybersecurity/LogonStealer](https://github.com/S12cybersecurity/LogonStealer)

Abuses the Credential Provider COM interface to steal plaintext passwords from `logonui.exe` via `CredProvDataModel.dll` hooks.

A Windows credential stealer implemented as a rogue Credential Provider DLL. It loads automatically into `logonui.exe` via COM registration (bypassing PPL) and hooks `CredProvDataModel.dll` to capture plaintext passwords at the Windows logon and lock screen.

---

## How It Works

Windows loads all registered Credential Providers into `logonui.exe` via `CoCreateInstance`.

On modern Windows 11, the password input does not pass through the classic `ICredentialProviderCredential::SetStringValue` method. Instead, it flows through a WinRT stack:

```
Windows.UI.Logon.dll
└── textinputframework.dll
    └── CredProvDataModel.dll  <- hook point
        └── ICredentialProvider (classic COM)
            └── winlogon (via WNF)
```

The `EditField` object inside `CredProvDataModel.dll` manages the password field. Its `put_Value` method (vtable slot 7) is called on every keystroke with the accumulated value, and `get_Value` (slot 6) is called at submit time with the final value. Both are hooked with Microsoft Detours.

## Technique

**CredProvDataModel EditField Hook**: hooks `put_Value` and `get_Value` on the WinRT `EditField` object inside `CredProvDataModel.dll`. This captures the password in plaintext regardless of which Credential Provider the user selects (password, domain, RDP, etc.).

Functions are resolved by **byte pattern scan** over the `.text` section of `CredProvDataModel.dll`, so no hardcoded RVAs or version pinning are required.

## Files and Projects

- **LocalCredStealerCP**: the main DLL source. This is the compiled Credential Provider that gets loaded into `logonui.exe`.
- **registerCP.bat**: installs the CP. Writes the registry keys needed. Needs to run as Administrator. After this, the next logon loads the DLL into `logonui.exe`.
- **unregisterCP.cmd**: reverses `registerCP.bat`. Deletes the same registry keys so Windows stops loading the DLL on logon. Also needs to run as Administrator.

## Deployment

1. Replace the DLL path inside `registerCP.bat`.
2. Execute `registerCP.bat` as Administrator.
3. Sign out or restart.
4. Log in.
5. Check `C:\cred_capture.log` for the entered plaintext password.

## Proof of Concept

```
<<>> ATTACH PID=11712
<<>> installing hooks
<<>> credprovdatamodel.dll @ 0x00007FFE30650000
<<>> scanning .text @ 0x00007FFE30651000 size=0x77B45
<<>> put_Value found @ 0x00007FFE3067BD70
<<>> get_Value found @ 0x00007FFE3068ADF0
<<>> hooks OK

[CRED] 2026-10-12 10:07:04
  password: 1234
```

---
> 📦 **Full-Text Markdown Snapshot** archived by [Phying News](https://phying.com/item/9087) · Original source: [github.com/S12cybersecurity/LogonStealer](https://github.com/S12cybersecurity/LogonStealer)