AmnesiaStealer hidden .pwd dotfile write tied to non-standard process

Duo Tech@duotech

•updated Aug 19, 2026•2•1•6

Detects cleartext storage of a phished password to a hidden dotfile (~/.pwd) or staging directory by a non-standard process, matching AmnesiaStealer's practice of persisting captured credentials to disk for reuse throughout its collection chain.