⌨️ Decoy Credential Injection

Simulated user activity that types monitored bait credentials, so credential-stealing malware captures and uses them.

→ Explore in ATT&CK matrix (2 mappings) Deployment detail

What it is

An agent drives believable user activity on a host or VM, such as opening a browser and logging in to a site with monitored bait credentials. Keyloggers and form-grabbers capture the bait like any real login. When the attacker later uses those credentials, the monitored account raises the alert and points to the machine where they were typed.

Implementation requirements

A monitored decoy account on a service you control, whose credentials exist only as bait
An agent that replays human-like input to log in with the bait on selected hosts; BotSwindler runs it from outside the VM so malware inside cannot see or tamper with it
Alert on any use of the bait credential, and map it back to the host and time it was typed
Safety: the bait account holds no real data or rights
Rollback: Stop the activity agent and disable the bait accounts.
Upkeep: Rotate the bait credentials and vary the activity schedule. Monthly proof-of-life use of the bait.

Cost

Moderate. Needs an injection agent and a monitored bait service.

Indicative only. Cloud pricing and licensing change — check the provider's official pricing pages for current rates before you budget.

Technologies

Endpoint

ATT&CK coverage 2

Technique	Tactic	Status	Confidence	Tier
T1056 Input Capture	Collection	confirmed	strong	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (2 sources) BotSwindler: Tamper Resistant Injection of Believable Decoys in VM-Based Hosts for Crimeware Detection — Bait credentials injected through simulated user input were captured, and then used, by real credential-stealing malware. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1056 Input Capture as an adversary behaviour.
T1056 Input Capture	Credential Access	confirmed	strong	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (2 sources) BotSwindler: Tamper Resistant Injection of Believable Decoys in VM-Based Hosts for Crimeware Detection — Bait credentials injected through simulated user input were captured, and then used, by real credential-stealing malware. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1056 Input Capture as an adversary behaviour.

Evidence

BotSwindler: Tamper Resistant Injection of Believable Decoys in VM-Based Hosts for Crimeware Detection — Bowen, B.; Prabhu, P.; Kemerlis, V.; Sidiroglou, S.; Keromytis, A.; Stolfo, S., RAID 2010 peer-reviewed
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard

Research basis: Bowen et al., BotSwindler (RAID 2010): bait credentials injected through simulated user input were captured and exploited by real credential-stealing malware; a computational analysis and a user study confirmed the simulations are believable.