A keylogger (keystroke logger) records every keystroke typed on a device, capturing passwords, messages, emails, credit card numbers, and other sensitive input. Keyloggers are a core component of spyware and are widely used in credential theft campaigns.
| Milestone | Year | Details |
|---|
| Hardware keyloggers | 1980s+ | Inline PS/2, USB devices |
| Software keyloggers | 1990s+ | API hooking, kernel drivers |
| Commercial spyware | 2000s+ | “Parental control” / “Employee monitoring” |
| Banking trojans | 2007+ | Zeus, SpyEye form grabbing |
| Type | Mechanism | Detection Difficulty |
|---|
| Hardware | Inline PS/2/USB, firmware | Very High (invisible to OS) |
| User-mode API | SetWindowsHookEx (WH_KEYBOARD) | Low (visible in hook chain) |
| Kernel driver | Keyboard class filter driver | High (Ring 0) |
| Form grabber | Hook browser APIs (PR_Read, etc.) | Medium-High |
| Acoustic | Audio analysis of keystrokes | Very High (air-gap capable) |
| Video | Screen/keystroke video capture | Medium |
| Keylogger | Type | Delivery |
|---|
| Zeus/Zbot | Form grabber + kernel | Trojan, drive-by |
| SpyEye | Form grabber | Trojan |
| Agent Tesla | User-mode hook | Phishing, SMTP |
| HawkEye | User-mode + kernel | Phishing, RAT |
| SnakeKeylogger | .NET, user-mode | Phishing, Agent Tesla fork |
- ✅ FIDO2/WebAuthn — Phishing-resistant, no passwords to steal
- ✅ Password manager — Auto-fill bypasses keyloggers
- ✅ Virtual keyboard — For high-value entry (banking)
- ✅ EDR with kernel callback monitoring — Detect filter drivers
- ✅ Hardware security keys — FIDO2, no secrets in memory
- ✅ Regular AV/EDR scans
- ✅ On-screen keyboard for sensitive entry (mitigates user-mode)
| Technique | ID | Description |
|---|
| Keylogging | T1056.001 | Keystroke capture |
| Input Capture | T1056 | All input capture methods |
