Pony Malware - Local Brute Force with Successful Impersonation via LogonUserA

Ethan Andrews@eandrews

•updated Jun 22, 2026•1•0•2

Detects the Pony malware credential harvesting sequence where a non-system process performs repeated interactive logon attempts (LogonUserA dictionary brute force via NetUserEnum) against local accounts and achieves at least one successful logon, after which LoadUserProfileA is used to impersonate the compromised account and harvest profile-scoped credentials.