Hackers Hijack Trust in KeePass: Weaponized Installer Used to Infiltrate Systems and Steal Credentials
Cybersecurity professionals are raising alarms as a new and highly deceptive cyberattack campaign targets KeePass, a widely used open-source password manager. Threat actors have begun leveraging manipulated versions of the software to infect devices and harvest sensitive data—all under the guise of legitimate functionality.
The campaign, active since April 2025, uses tampered KeePass installers distributed via fraudulent websites and phishing campaigns. These counterfeit downloads look and behave like the genuine application, making them virtually indistinguishable at first glance. However, embedded within is stealthy malware that operates silently in the background.
Researchers have confirmed that attackers are disseminating these compromised installers through phishing emails and malvertising, rerouting users to fake KeePass sites that mirror the official platform’s design. Once installed, the rogue version performs password management as expected, while covertly launching code that enables credential theft and surveillance.
The discovery came after WithSecure began investigating a surge of unexplained breaches involving users who reported strong password security habits. According to Principal Threat Researcher Mika Aalto, the malware is particularly elusive.
“This is a deeply engineered supply chain compromise. It’s not just a fake interface—the attackers have cloned the entire experience to delay suspicion, with the malicious payload lying dormant for days before activating,” Aalto explained.
Early forensic analysis indicates thousands may already be affected, especially across sectors like finance, healthcare, and public institutions. The malware doesn’t stop at the KeePass vault—it actively scans infected machines for browser-stored passwords, session cookies, and even digital wallet credentials.
What sets this attack apart is its subversion of trust. By targeting a tool meant to safeguard user identities, attackers gain near-complete access to victims’ digital lives.
Malware Behavior and Technical Breakdown
Upon installation, the malicious KeePass clone initiates an authentic-looking setup process. Behind the scenes, it deploys a disguised DLL designed to imitate core KeePass components. This hidden module quietly performs unauthorized data collection while keeping the primary user interface intact and fully functional.
Security analysts warn that this attack represents a dangerous evolution in cybercrime: infiltrating the very tools users rely on to stay safe. As trust in software supply chains continues to erode, experts emphasize the need for integrity checks, verified downloads, and heightened user awareness to counter this new breed of deception.
Inside the KeeLoader Malware: How Attackers Hijack KeePass from Within
The malware component dubbed “KeeLoader” takes advantage of a classic yet potent exploitation method: DLL search order hijacking. By planting a rogue dynamic-link library with a filename that mimics a legitimate KeePass dependency, the malware ensures it’s automatically loaded every time the real application launches—blending in undetected.
At the core of its functionality is a cleverly placed hook into KeePass’s encryption engine. Below is a reconstructed version of the malicious logic used to intercept and leak decrypted password data:
C#
// Intercepts and exfiltrates decrypted content
public static byte[] ProcessEncryptedData(byte[] encryptedData, byte[] key)
{
// Call the original KeePass decryption function
byte[] decryptedData = OriginalProcessEncryptedData(encryptedData, key);
// Quietly siphon off sensitive data
if (IsConnectedToInternet() && !IsEmulatedEnvironment())
{
SendOutData(decryptedData, "pwd_dump");
}
return decryptedData;}
Rather than alter the UI or disrupt normal app behavior, KeeLoader acts as an invisible proxy inside the application—stealing decrypted information before the user even sees it.
To evade detection and enhance stealth, the malware sends stolen credentials in small, encrypted fragments embedded within DNS traffic, a method chosen because DNS requests typically bypass deep packet inspection and raise fewer red flags than conventional channels like HTTP or email.
Once a KeePass vault is accessed, the malware silently captures everything: the master password, stored logins, and any other credentials the user unlocks. It then ensures long-term persistence through a fileless strategy—embedding its payload directly into Windows Registry keys and using misleadingly named scheduled tasks to reinitiate itself, even after surface-level cleanup.
The use of DNS tunneling, registry-based persistence, and in-app credential interception reflects an alarming escalation in how attackers repurpose trusted tools for hostile surveillance—blurring the lines between legitimate software functionality and malicious exploitation.
