OS Credential Dumping
OS Credential Dumping is when a hacker steals digital 'keys'—like passwords or secret codes—that a computer has saved in its memory. Once they have these keys, they can pretend to be a legitimate user to sneak into other parts of the system, such as AI tools or private company data.
OS Credential Dumping involves the unauthorized extraction of authentication material, such as clear-text passwords, hashes, or session tokens, from system memory or local caches. In an AI environment, these stolen credentials are used to bypass authentication mechanisms, enabling lateral movement into AI inference APIs, model endpoints, or DevOps pipelines.
OS Credential Dumping is the technique of accessing and exfiltrating authentication artifacts—including NTLM hashes, Kerberos tickets, clear-text credentials, and OAuth tokens—residing in volatile memory (LSASS), registry hives, or application-specific caches. Within the AI security domain, this technique facilitates the compromise of service accounts and API keys, allowing adversaries to escalate privileges and move laterally to interact with AI agents, LLM training infrastructure, and sensitive model deployment environments.