Anomalous CredUIPromptForWindowsCredentialsW Invocation

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•9

Detects anomalous script interpreters referencing CredUIPromptForWindowsCredentialsW to spoof password prompts. This function is typically used to display a credential prompt to the user. Its presence in the command line of scripting tools like PowerShell, cmd, or Python suggests an attempt to spoof legitimate credential prompts, potentially for phishing or credential harvesting.