APT42G1044 ↗
Has stolen application specific passwords in order to bypass MFA requirements to include victim environments who leverage the Microsoft App Password feature. 1
tfMITRE ATT&CK technique
Steal Application Specific Passwords T1697
- Tactic
- Credential Access
- Platforms
- Office Suite, Identity Provider, SaaS
- Version
- 1.0
- Created
- 17 September 2026
- Last modified
- 06 October 2026
Adversaries may steal Application Specific Passwords (ASPs) to gain access to Valid Accounts, bypassing multifactor authentication (MFA) methods. ASPs are passwords typically used to give third-party applications or legacy devices (which do not support MFA methods) account access.[1][2]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
1
Threat groups44th pct
Threat groups44th percentile · 56% of ATT&CK techniques have more threat groups attributed.0
CampaignsNone recorded
CampaignsNone recorded · 53% of ATT&CK techniques have none either.0
Tools & malwareNone recorded
Tools & malwareNone recorded · 30% of ATT&CK techniques have none either.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.