Lock screen phishing is a credential theft technique that copies the Windows sign-in or lock screen so a victim thinks they are re-entering a legitimate password after a system event, update, or remote-access prompt. Because the interface looks native to the desktop, users may type their Windows credentials directly into an attacker-controlled window instead of a real login screen.
This matters because Windows passwords can unlock email, files, VPN access, and other internal services, especially if the same credentials are reused. In real attacks, lock screen phishing often follows social engineering: a user is persuaded to run an installer or accept support help, then a fake lock screen appears to harvest the password. Defenders should watch for unexpected full-screen prompts, unusual installer behavior, and script or process activity that appears before the credential request. User verification of support requests and strong multifactor authentication reduce the impact if credentials are stolen.