Forced Authentication (T1187)

Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information through a mechanism in which they can intercept.

Tactics
TA0006

See: MITRE ATT&CK