CAPEC-654
Credential Prompt Impersonation
An adversary, through a previously installed malicious application, impersonates a credential prompt in an attempt to steal a user's credentials.
On this page
The adversary may monitor the task list maintained by the operating system and wait for a specific legitimate credential prompt to become active. Once the prompt is detected, the adversary launches a new credential prompt in the foreground that mimics the user interface of the legitimate credential prompt. At this point, the user thinks that they are interacting with the legitimate credential prompt, but instead they are interacting with the malicious credential prompt.
A second approach involves the adversary impersonating an unexpected credential prompt, but one that may often be spawned by legitimate background processes. For example, an adversary may randomly impersonate a system credential prompt, implying that a background process or commonly used application (e.g., email reader) requires authentication for some purpose. The user, believing they are interacting with a legitimate credential prompt, enters their credentials which the adversary then leverages for nefarious purposes. The ultimate goal of this attack is to obtain sensitive information (e.g., credentials) from the user.
Ask an AI about this attack pattern
Show the prompt
Explain the attack pattern CAPEC-654: Credential Prompt Impersonation: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/654.html and https://cve.bz/cve/capec/654?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.
How the attack unfolds
Explore
The attacker looks for a way in.
[Determine suitable tasks to exploit] Determine what tasks exist on the target system that may result in a user providing their credentials.
1 technique
- Determine what tasks prompt a user for their credentials.
Exploit
They carry out the attack.
[Impersonate Task] Impersonate a legitimate task, either expected or unexpected, in an attempt to gain user credentials.
1 technique
- Prompt a user for their credentials, while making the user believe the credential request is legitimate.
Prerequisites
The adversary must already have access to the target system via some means.
A legitimate task must exist that an adversary can impersonate to glean credentials.
Skills required
- Low skill
Once an adversary has gained access to the target system, impersonating a credential prompt is not difficult.
Resources required
Malware or some other means to initially comprise the target system.
Additional malware to impersonate a legitimate credential prompt.
Signs of an attack
Credential prompts that appear illegitimate or unexpected.
Consequences
| Impact | Affects | Note |
|---|---|---|
| Gain Privileges | Access Control, Authentication |
Mitigations
The only known mitigation to this attack is to avoid installing the malicious application on the device. However, to impersonate a running task the malicious application does need the GET_TASKS permission to be able to query the task list, and being suspicious of applications with that permission can help.
Weaknesses it exploits
- CWE-1021 Improper Restriction of Rendered UI Layers or Frames
Recent CVEs with these weaknesses
- 2.5CVE-2026-18194
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to perform unauthorized actions due to missing anti-clickjacking controls.
- 5.1CVE-2026-123529
Vikunja before 2.7.1 contains a stored CSS injection vulnerability that allows authenticated users with project write access to inject arbitrary CSS via unsanitized table-cell data-background-color attributes. Attackers can store crafted t…
- 3.5CVE-2026-123850
In JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via configuration directives
- 3.1CVE-2026-21834
HCL AION is affected by a vulnerability where the Content-Security-Policy (CSP) security response header was missing from application responses. Without this header, the browser does not restrict the sources of scripts and other content, i…
- 5.3CVE-2026-123311
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 command execution via a hidden run control in the Markdown preview was possible
- 5.3CVE-2026-18159
A vulnerability in OpenText OpenText Directory Services (OTDS) on Windows and Linux allows Clickjacking. This issue affects OpenText Directory Services (OTDS): from 10.5 through 26.2.
- 4.6CVE-2026-108536
IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to improper restriction of rendered UI layers or frames.
- 5.1CVE-2026-108049
Clickjacking vulnerability in the Alosuite web application. The affected login interface can be embedded in a web page controlled by an attacker because it does not implement adequate user interface protection mechanisms, such as the X-Fra…
The newest records naming one of them. Each weakness's page lists them all.
Related attack patterns
- Part of
- CAPEC-504 Task Impersonation
Examples
An adversary monitors the system task list for Microsoft Outlook in an attempt to determine when the applicat…
An adversary monitors the system task list for Microsoft Outlook in an attempt to determine when the application may prompt the user to enter their credentials to view encrypted email. Once the task is executed, the adversary impersonates the credential prompt to obtain the user's Microsoft Outlook encryption credentials. These credentials can then be leveraged by the adversary to read a user's encrypted email.
An adversary randomly prompts a user to enter their system credentials, tricking the user into believing that…
An adversary randomly prompts a user to enter their system credentials, tricking the user into believing that a background process requires the credentials to function. The adversary can then use these gleaned credentials to execute additional attacks or obtain data.
MITRE's words, unchanged: CAPEC-654 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.