New DPAPISnoop Tool Enables Extraction of CREDHIST Hashes From Windows Systems

Gbhackers •Divya • June 15, 2026

A newly enhanced version of the open-source DPAPISnoop tool is drawing attention in the security community after researchers demonstrated its ability to extract offline-crackable hashes from Windows DPAPI credential history (CREDHIST) files, potentially exposing historical password material and enabling deeper insight into user password patterns over time. New DPAPISnoop Tool Developed by Nettitude’s CyberLabs team, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Enhanced DPAPISnoop Tool Exposes Windows Credential History Vulnerabilities The DPAPISnoop tool has been upgraded to extract CREDHIST hashes from Windows systems, allowing for offline cracking of historical credentials. This tool, developed by Nettitude’s CyberLabs, enables the recovery of sensitive password data, potentially affecting numerous Windows users. Security Consultant Lefteris Panos indicated that the update enhances the tool's capabilities, providing deeper insights into user password patterns over time. The extraction of CREDHIST entries poses a significant risk to user security, as it may lead to unauthorized access to historical passwords. The tool's open-source nature allows widespread access, increasing the potential for misuse. Current status indicates that the security community is actively analyzing the implications of this tool's capabilities. 2 sources 52

Extracted Entities

New DPAPISnoop Tool Enables Extraction of CREDHIST Hashes From Windows Systems

The full story

Extracted Entities

MITRE ATT&CK (1)

Platforms (1)

Tools (1)