A credential sniffer is a malware module or scanning component that searches for valid login credentials, often by testing or identifying default usernames and passwords on exposed devices and services. The exact technique may vary, but the goal is the same: find an easy way in without exploiting a complex vulnerability.
This matters because default credentials remain one of the most common causes of compromise in IoT, routers, cameras, and management interfaces. In botnets and other automated attacks, a credential sniffer helps the malware spread faster by locating weak access points at scale. Defenders reduce this risk by changing factory passwords, disabling unused accounts, enforcing unique credentials, and monitoring for repeated login attempts or authentication failures. When combined with stealthier command traffic, such modules can make malware both harder to spot and easier to deploy.