MITRE ATT&CKsoftware (malware)

S9022 MirrorStealer

Published 2026-04-17 Modified 2026-04-24 Official page ↗
Domain
enterprise
Platforms
Windows
Version
1.0
Created
2026-04-17

Description

MirrorStealer is a credential stealer that has been used by MirrorFace since at least 2022 to steal credentials from various applications, including browsers and email clients. MirrorStealer has been delivered directly into system memory via commands issued by LODEINFO.

Related

Uses · MITRE ATT&CK (4)

  • T1074.001 Local Data Staging sub-technique
  • T1555.003 Credentials from Web Browsers sub-technique
  • T1552.006 Group Policy Preferences sub-technique
  • T1555 Credentials from Password Stores technique

Referenced by MITRE ATT&CK · uses (1)

References