Credential extraction is the collection of secrets that let an attacker reuse someone else’s access. Those secrets can include passwords, password hashes, session tokens, API keys, Kerberos tickets, browser cookies, or material recovered from system memory. The goal is not always to steal data immediately; it is often to gain durable access that can be reused later, sometimes without triggering a fresh login prompt.
This matters because extracted credentials can turn one compromised endpoint into wider network access. Attackers may use legitimate tools, memory dumps, or misconfigured admin utilities to locate secrets in RAM, files, or browser stores. Defenders look for unusual process launches, memory access, and suspicious use of forensic or administrative tools. Limiting privilege, protecting secrets in memory, enabling MFA, and monitoring for credential dumping activity all reduce the value of extraction during an intrusion.