TokenGrabber Stealer: Netsh Wi-Fi Profile Enumeration and Cleartext Key Dump

Ankit Mehta@Secvyn

•updated Sep 28, 2026•0•0•2

Detects the enumeration of Wi-Fi profiles followed by the extraction of clear-text credentials for those profiles using the Windows 'netsh wlan' command. This pattern is commonly observed during post-exploitation activities to retrieve stored Wi-Fi passwords.