Password Sniffer - What it is, red flags, and how to protect your accounts

Password Sniffer

What it is

A password sniffer is malware or a rogue tool that captures login credentials as they travel over a network. On unsafe Wi-Fi or misconfigured systems, it can read usernames, passwords, cookies, and session tokens to hijack accounts without you noticing.

Why it matters

Once a sniffer steals a password or session, attackers can log in as you, change recovery info, move money, or pivot deeper into company systems.

How it works - quick tour

  • Listens to traffic: puts the network card in promiscuous mode to read packets.

  • Man-in-the-middle: uses ARP spoofing, rogue APs, or proxies to sit between you and a site.

  • Credential grabs: targets plaintext logins, weak protocols, or session cookies on partially encrypted sites.

  • Exfiltration: sends captured data to a command server for later use.

What you may notice

  • Certificate or padlock warnings on sites that should be secure.

  • Forced logouts, unusual login alerts, or new devices on your accounts.

  • Unknown root certificates, proxy settings, or VPN profiles added.

  • On corporate nets: IDS alerts about ARP spoofing or promiscuous interfaces.

If you suspect it - first moves

  1. Disconnect from the network and switch to cellular.

  2. From a clean device, change passwords and enable MFA on email, banking, and cloud.

  3. Run a full anti-malware scan, reboot, then scan again.

  4. Remove unknown proxies, certificates, VPNs, and browser extensions.

  5. Review account activity and sign out of other sessions.

Prevent it

  • Prefer HTTPS everywhere and use a VPN on public Wi-Fi.

  • Turn on MFA so stolen passwords alone are not enough.

  • Keep OS, browsers, and apps updated; disable legacy protocols.

  • Avoid auto-connecting to open networks and forget untrusted SSIDs.

  • For teams: segment networks, enable HSTS/DoH/DoT, monitor for MITM and ARP spoofing, and restrict SPAN/mirror ports.

    Glossary (A–Z)

    All A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

      • Related Articles

      • Malware

        What it is Malware is any software made to harm your device or data. It can steal passwords, lock your files, spy on activity, or hijack your browser. For a quick primer and examples, see our malware explainer. How it spreads Phishing emails and fake ...

      • Data Execution Prevention

        What it is Data Execution Prevention (DEP) is a Windows safety net that stops code from running in places it shouldn’t—like the stack or heap. If malware tries to execute from those memory areas, Windows blocks it and shuts the app down instead of ...

      • Shadow Password Files

        What it is Shadow password files are special system files on Unix/Linux that store the password hashes (not the actual passwords) for user accounts. Public info about users lives in /etc/passwd, while the sensitive, hashed passwords are kept in ...

      • LokiBot (Loki Password Stealer)

        LokiBot (Loki Password Stealer) What it is LokiBot is a credential-stealing trojan that targets Windows and Android. It grabs passwords, cookies, and wallet data, can take screenshots, and sometimes opens a backdoor for more malware. Technical ...

      • Security Software

        What it is Security software is a set of apps and services that protect your devices and data from hackers, malware, and mistakes. It covers tools like antivirus/anti-malware, firewalls, VPNs, email and web filters, intrusion detection/prevention, ...