S12cybersecurity / LogonStealer

# LogonStealer
> Abuses the Credential Provider COM interface to steal plaintext passwords from logonui.exe via CredProvDataModel.dll hooks
A Windows credential stealer implemented as a rogue Credential Provider DLL. It loads automatically into `logonui.exe` via COM registration (bypassing PPL) and hooks `CredProvDataModel.dll` to capture plaintext passwords at the Windows logon and lock screen
---
## How it works
Windows loads all registered Credential Providers into `logonui.exe` via `CoCreateInstance`.
On modern Windows 11, the password input does not pass through the classic `ICredentialProviderCredential::SetStringValue` method. Instead, it flows through a WinRT stack:
 [code]