BothanSpy and Gyrfalcon steal the SSH Credentials from both Windows and Linux Platform and both tools are performing in Different OS Platform and Different Attack vector. Both tools will exfiltrate the stolen credentials to a CIA-controlled server or save it in an encrypted file and later it exfiltration to the CIA Controlled Server. The tool has some advance functions that can not only steal user credentials of active SSH sessions but is also capable of collecting full or partial OpenSSH session traffic.”]