MobaXterm Credentials Decryption for Lateral Movement

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•1•0•9

Detects a MobaXterm credential decryption utility reading session configuration or registry data before SSH or RDP activity, indicating potential credential access for lateral movement.