Which of the following security threats does NOT use software to extract sensitive information or credentials?

Grayware is a category of unwanted software (adware, spyware, tracking tools) that uses code to extract or transmit user data.

Shoulder surfing relies entirely on a human physically looking over another person's shoulder to observe passwords, PINs, or other sensitive input. Unlike all other listed threats, it requires no malicious software, network access, or code execution - it is a purely social engineering and physical security threat.

Malware is by definition malicious software designed to steal credentials or sensitive information from a system.

Man-in-the-Middle exploits use software or network tools to intercept and read communications between two parties.