RDPThief

RdpThief is a Windows C++ credential-access tool. Its Cobalt Strike Aggressor script polls the Beacon host's process list every 5 seconds and injects its x64 shellcode into newly observed mstsc.exe processes. The injected DLL hooks RDP credential-handling APIs and writes captured clear-text credentials to %TEMP%\data.bin; the Aggressor dump command reads that file into the Cobalt Strike console. It requires a user to use the Windows RDP client; MDSec reports that the compromised user's privileges can suffice without SYSTEM or elevation.