---
id: 9860
title: "Persistent Credential Theft with Authorization Plugins"
source_domain: specterops.io
source_url: "https://specterops.io/blog/2018/10/17/persistent-credential-theft-with-authorization-plugins/"
published_at: "2018-10-17T13:53:00Z"
phying_url: "https://phying.com/item/9860"
lang: en
---

# Persistent Credential Theft with Authorization Plugins

## Summary

Credential theft is often one of the first tactics leveraged by attackers once they’ve escalated privileges on a victim’s machine. Credential theft on OSX has become more difficult with the introduction of System Integrity Protection (SIP). Attackers can no longer use methods such as extracting the master keys from the securityd process and decrypting the victim’s login […]

## Intelligence Metadata

- **Sources:** specterops.io
- **Published:** 2018-10-17T13:53:00Z
- **Original:** https://specterops.io/blog/2018/10/17/persistent-credential-theft-with-authorization-plugins/
- **Phying News:** https://phying.com/item/9860