Gifting User Passwords to Adversaries With NPPSPY | Huntress

Huntress documented a confirmed intrusion where adversaries used the NPPSPY method — registering an attacker-controlled Network Provider DLL to intercept Winlogon cleartext credentials and persist them to disk (example: C:\Windows\Temp\tmpCQOF.tmp), including credentials observed from an Exchange server; the report details IOCs (registry values, service name 'logincontroll', malicious DLL path), detection approaches, and remediation steps.