Bulk export of stolen Dahua credentials into SMART PSS XML batches

Ibrahim Saud@tektrix

•updated Sep 20, 2026•0•0•3

Detects bulk file creation of XML files associated with Dahua credential exports, likely generated by a Python script, which is indicative of credential harvesting or staging for exfiltration.