PasswordsCon

This full-day stream of the PasswordsCon track opens with a walkthrough of an infostealer-style attack chain, from a malicious file the victim runs through privilege escalation to dumping Windows credentials. The speaker shows how DPAPI-protected browser and vault secrets can be decrypted once an attacker reaches system privileges, and maps each step to MITRE ATT&CK techniques. Later sessions cover password cracking methodology, including attack modes, masks, hash identification and why legacy formats such as LM and NTLMv1 fall quickly while DCC2 is slow.

The middle of the stream focuses on identity. One talk argues that static API keys should give way to cryptographically verifiable workload identities, with SPIFFE and cloud token federation as practical routes. Another looks at passkeys, comparing synced and device-bound variants, and explains how enrollment and account recovery flows can be abused. A third shows that many services accept email addresses as identity, so Gmail dot variants and similar aliases can deliver account notices and recovery messages to the wrong person. A GitLab case study then shows that per-project inbound email addresses can act as credentials that create issues and push code.

The final talks cover the infostealer economy, including malvertising, stolen session cookies that bypass MFA, and operators who infected themselves. The stream closes with honey tokens as decoy credentials and with AI agents treated as non-human identities that prompt injection can steer. The practical takeaways are to treat endpoints as the perimeter, scope and rotate secrets, verify passkey enrollment, and treat email-based tokens as credentials.