DPAPISnoop Tool Extracts CREDHIST Hashes for Offline Windows Credential Recovery

Cybersecuritynews •Abinaya • June 15, 2026

The open-source DPAPISnoop tool has been enhanced to extract CREDHIST entries, enabling offline cracking of historical Windows credentials and deeper insight into password patterns. Lefteris Panos, Security Consultant at LRQA Red Team, said the update adds CREDHIST extraction capabilities to DPAPISnoop, enabling the recovery and analysis of historical Windows credentials alongside DPAPI Master Key hashes. […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Enhanced DPAPISnoop Tool Exposes Windows Credential History Vulnerabilities The DPAPISnoop tool has been upgraded to extract CREDHIST hashes from Windows systems, allowing for offline cracking of historical credentials. This tool, developed by Nettitude’s CyberLabs, enables the recovery of sensitive password data, potentially affecting numerous Windows users. Security Consultant Lefteris Panos indicated that the update enhances the tool's capabilities, providing deeper insights into user password patterns over time. The extraction of CREDHIST entries poses a significant risk to user security, as it may lead to unauthorized access to historical passwords. The tool's open-source nature allows widespread access, increasing the potential for misuse. Current status indicates that the security community is actively analyzing the implications of this tool's capabilities. 2 sources 52

Extracted Entities

DPAPISnoop Tool Extracts CREDHIST Hashes for Offline Windows Credential Recovery

The full story

Extracted Entities

MITRE ATT&CK (1)

Platforms (1)

Tools (1)