> I don't think it would help here, they were stealing credentials

So, stealing credentials in the current directory and in all other directories are the same thing?