Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service.

Tactics
TA0006 TA0009

Sub-technique of
T1056


See: MITRE ATT&CK