Pass-the-Hash: how the NTLM attack works without the password

Thu, 17 Sep 2026 10:00:00 -0300

An attacker compromises a workstation on the corporate network. They don't have the domain administrator's password — but that doesn't matter. With the NTLM hash extracted from memory, they authenticate to dozens of servers as if they were the administrator themselves. This is Pass-the-Hash: an attack that has existed since 1997, documented by researcher Paul Ashton, and that still fuels the early stages of ransomware attacks and APT campaigns today.

Credential Theft on Locodigital

Pass-the-Hash: how the NTLM attack works without the password