Home/ MITRE Matrix/ Collection/ T1056.003

T1056.003Web Portal Capture

T1056.003 — Web Portal Capture is a MITRE ATT&CK technique in the Collection tactic. Clankerusecase tracks 4 detection use cases covering it and 4 threat-intel articles citing it.

CollectionCredential Access

View on the matrix → Filter Detection Library MITRE official spec ↗

4Use cases

4Articles

0Sub-techniques

2Tactics

↑ Parent technique: T1056 · Input Capture

Use cases covering this technique (4)

[LLM] Endpoint traffic to cubepilot.org during 24 Jul 2026 DNS-hijack / AiTM window Bespoke delivery · hunting DSPDDCS [LLM] Connection to Beamglea phishing credential-harvesting domains Bespoke actions · alerting DSΣPDDCS [LLM] Browser/HTTPS traffic to npmjs.help credential-harvesting page Bespoke delivery · alerting DSΣPDDCS [LLM] Form-skimmer exfil to js-metrics.com (malicious angular-bmap / ng-ui-library npm versions) Bespoke actions · alerting DSΣPDDCS

Articles citing this technique (4)

high CubePilot drone software dev hit by DNS hijacking to intercept traffic art-37

crit Phishing Campaign Leveraging the NPM Ecosystem art-823

high npm Supply Chain Attack via Open Source maintainer compromise art-855

high Angular vs React: the security risk of indirect dependencies art-3462