![Cybercriminals Using PowerShell to Steal NTLMv2 Hashes from Compromised Windows Cybercriminals Using PowerShell to Steal NTLMv2 Hashes from Compromised Windows](https://search.ai.wiki/wp-content/uploads/2023/09/cybercriminals-using-powershell-to-steal-ntlmv2-hashes-from-compromised-windows.jpg)
Cybercriminals Using PowerShell to Steal NTLMv2 Hashes from Compromised Windows
A new cyber attack campaign is leveraging the PowerShell script associated with a legitimate red teaming tool to plunder NTLMv2 hashes from compromised Windows systems primarily located in Australia, Poland, and Belgium.
The activity has been codenamed Steal-It by Zscaler ThreatLabz.
"In this campaign, the threat actors steal and exfiltrate NTLMv2 hashes using customized versions of Nishang's