ctrlINT What the industry said about every indicator, with the quote

ntuser[.]manDomain

Reported by 1 independent source · first reported by Silent Push · last reported

Last reported 22 days ago

What the reports say

1 report, newest first · the exact sentence from each

  1. “Ontinue said the tool included a fake Windows lock screen to collect passwords and a persistence method that forges an NTUSER[.]MAN profile hive without administrator privileges.”

    Silent PushVendor
    Weekly Cybersecurity Roundup: How Stolen Credentials Continue to Fuel Fraud

Indicators reported together

named in the same reports

Also named with it: CVE-2026-73570

Thanks — we review every report.

Report a wrong value
What is wrong with ntuser[.]man here?
No account needed. We do not store your IP address.