High severity Malware

Keylogger

Records keystrokes to capture credentials, messages and one-time codes before they are encrypted.

Overview

Keyloggers come as user-mode hooks, drivers, or accessibility-API abuse, and increasingly screenshot the screen instead of the keyboard.\nTheir value lies in capturing secrets at the moment of entry, including tokens typed into a field that no memory dump would reveal.\nHardware variants on the cable itself defeat all software controls.

Indicators of Compromise

Signals that suggest this is present on a system.

Unknown processes subscribing to keyboard hooks
Unexpected drivers installed
Periodic screenshots written to temp folders

References

Related entries

Spyware High
Ransomware Critical
Banking Malware Critical
Mobile Malware High

Related glossary terms

Zero-Day
A vulnerability being exploited before the vendor has a patch available, so defenders have...
Cross-Site Scripting (XSS)
Injecting script into a page so it runs in another user's browser session, enabling cookie...
Principle of Least Privilege
Every account, process and token receives only the minimum permissions required for its ta...

Check your site anyway

This entry is background reading rather than a scanner check. The free scan still reports the exposures we do cover: security headers, TLS, DNS and domain reputation.

Run a free scan

← All malware