Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information through a mechanism in which they can intercept. Tactics TA0006 See: MITRE ATT&CK
