Hackers Pose as Domain Controllers to Steal Active Directory Password Hashes