1. Home
  2. Software
  3. TRUSTTRAP

TRUSTTRAP

TRUSTTRAP is a malware that uses a fictitious prompt to trick users to submit their credentials.[1] TRUSTTRAP was first observed in 2023 and has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[1]

ID: S9064
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.0
Created: 01 October 2026
Last Modified: 01 October 2026
Version Permalink
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1074 .001 Data Staged: Local Data Staging

TRUSTTRAP has saved stolen credentials in a cleartext file.[1]
Enterprise T1056 .002 Input Capture: GUI Input Capture

TRUSTTRAP has captured victims’ credentials using fake login popup and stores captured data in a file.[1]
Enterprise T1684 .001 Social Engineering: Impersonation

TRUSTTRAP has a function to prompt the user with a fake popup that impersonates the Microsoft Outlook login window.[1]

Groups That Use This Software

ID Name References
G1059 NIMBUS MANTICORE

TRUSTTRAP has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[1]

References

  1. El-Banna, M., et al. (2025, November 17). Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem. Retrieved September 28, 2026.