## Credential Harvesting Detected

**Context:** As the operation progressed, signs of credential harvesting were detected, indicating an attempt to gain further access and control.

### Observations:
- **Keylogging Activity**: The backdoor included keylogging functionality to capture user credentials.
- **Credential Dumping**: Tools were deployed to extract saved credentials from web browsers and password vaults.

### Countermeasures:
- Enforce multi-factor authentication (MFA) to limit the impact of credential theft.
- Educate users on secure password practices and the risks of password reuse.