"In the process of trying to install what it thinks is an Ethernet adapter, the target machine will send its credentials over the spoofed network."
Am I the only one who read this and thought "huh"? Where is it sending these "credentials"? Are we talking domain joined PCs authenticating to update AD DNS or something? How is it getting around encryption?