Software keyloggers: intercept the keyboard via API hooks (SetWindowsHookEx), raw input reading or kernel-mode drivers, and typically capture the clipboard, form fields and screenshots as well. They arrive through phishing, malvertising, cracks and fake installers.
What is a keylogger?
A keylogger is a program or physical device that records every keystroke typed on a machine —passwords, messages, card numbers— and stores or exfiltrates it for a third party to exploit. They come in two families: software keyloggers, installed as malware through phishing, cracked software or compromised downloads, and hardware keyloggers, small adapters slotted between the keyboard and the computer. Today they rarely operate alone: keystroke capture is just one module of modern infostealers, which combine it with the theft of browser-saved credentials, session cookies and cryptocurrency wallets.
Why does it matter?
Stealing valid credentials is step one in a large share of intrusions: with a real username and password, the attacker does not need to exploit anything — they just log in. A keylogger turns every keystroke an employee types into raw material for that access: VPN, corporate email, business banking, the ERP. The criminal economy has industrialised the process: infostealers package what they capture into "logs" sold for a few dollars on Telegram markets and specialised forums, and buyers use them for business email compromise, ransomware deployment or extortion. Multi-factor authentication reduces the damage considerably but does not eliminate it: stealers also grab already-authenticated session cookies, which let the attacker in without any second factor firing. Detection is hard by design —keyloggers run in the background, using hooking techniques or kernel-level drivers— so a realistic defence combines prevention, EDR telemetry and a response plan that assumes captured credentials are already out the door.
Key points
Hardware keyloggers: USB or PS/2 inline adapters, modified keyboards and wireless keyboard sniffers. They are invisible to security software and remain relevant on shared machines, reception desks, kiosks and training rooms.
Infostealers as the evolution: families like Lumma, RedLine or Raccoon combine keylogging with theft of browser passwords, cookies, session tokens and autofill data. The output is sold as 'logs' on criminal markets and feeds much larger breaches.
From keyboard to breach: credentials captured today become VPN access tomorrow and lateral movement next week. Many serious incidents start with a single stealer-infected endpoint.
Detection: signature antivirus lags because stealers are repackaged daily. What works is behavioural EDR telemetry (hooks, access to credential stores, exfiltration), control of authorised USB devices, and threat hunting over outbound traffic.
Structural mitigation: phishing-resistant MFA (passkeys/FIDO2), a corporate password manager, least privilege on workstations, and a procedure that rotates credentials and revokes active sessions as soon as an infection is confirmed.
Example: An infostealer with a keylogger on an executive's laptop
An executive searches for a PDF converter and clicks a sponsored ad that mimics the legitimate site. The installer works, but it also deploys an infostealer with a keylogging module. For three days the malware records everything typed —including the corporate email password and the business banking login— and exfiltrates the browser's password vault and the Microsoft 365 session cookies on top. The 'log' is sold that same week; the buyer opens the mailbox using the stolen cookie, without triggering a single MFA prompt, and studies the invoice threads to stage a business email compromise.
Detection comes when the EDR flags a process reading the browser's credential store. The right response is not just cleaning the laptop: the SOC isolates it, every password typed or saved on that machine is rotated, active Microsoft 365 sessions and tokens are revoked, mailbox rules created by the attacker are reviewed, and forensic analysis confirms what left the machine and since when. Without those steps, reimaging the laptop leaves the attacker inside with valid credentials.
Common mistakes
- Relying on traditional antivirus alone: infostealers are recompiled and repackaged daily to evade signatures. Without behavioural telemetry (EDR) and control over what gets installed, the capture window can last for weeks.
- Treating MFA as absolute protection. A modern keylogger also steals cookies and session tokens that bypass the second factor, and MFA fatigue does the rest. Only phishing-resistant factors (FIDO2/passkeys) genuinely close that path.
- Cleaning the machine and closing the case without rotating credentials or revoking sessions. What was captured is already gone: if everything typed and saved on that machine is not changed and revoked, the attacker does not need to reinfect — they already hold the keys.
- Forgetting the physical vector: shared computers, classrooms, reception desks and public-facing workstations are candidates for a 20-euro hardware keylogger no software will ever detect. Periodic inspection and controlled USB ports.
- Ignoring personal (BYOD) devices that access corporate email or the ERP: a stealer on an employee's home laptop captures corporate credentials just like one on the office workstation, but outside the EDR's visibility.
Related terms
Related services
This concept may be related to services such as:
Frequently asked questions
How do I know if there is a keylogger on my company laptop?
Visible symptoms (slowness, odd processes) are unreliable: a well-built keylogger goes unnoticed. What works is telemetry: an EDR detects keyboard hooks, anomalous access to the browser's credential store and outbound connections to exfiltration infrastructure. If you have a concrete suspicion —for instance, accounts being compromised with no explanation— do not settle for an antivirus scan: isolate the machine and request forensic analysis, because the important question is not only "is it infected?" but "what has it taken, and since when?". On shared machines, physically check the keyboard cable and USB ports too.
We use MFA across the company — is a keylogger still a problem?
Yes. Classic MFA (SMS, push, OTP) protects the password, but current infostealers also steal cookies and tokens from already-authenticated sessions: the attacker imports the cookie into their own browser and gets in without the second factor ever firing. Meanwhile, everything you type is still captured: confidential text, customer data, credentials for systems without MFA. The answer is twofold: move critical access to phishing-resistant factors such as passkeys, and shorten session lifetimes with conditional access policies, so that a stolen cookie expires quickly and sessions can be revoked in bulk after an incident.
What should I do first if I suspect a machine has a keylogger?
Isolate it from the network without powering it off (to preserve volatile evidence) and treat the case as incident response, not maintenance. Then assume everything typed and saved on that machine is compromised: rotate the passwords from a separate clean device, revoke active sessions and tokens (Microsoft 365, VPN, SaaS applications) and check for mail-forwarding rules or anomalous sign-ins. Only then does reimaging make sense. If there is no internal team to do this properly, a managed SOC or a digital forensics service covers exactly that gap.
Do password managers protect against keyloggers?
More than people tend to assume, with caveats. By autofilling credentials, the manager avoids typing the password at all, so a pure keylogger never captures it; it also enables unique passwords per service, which contains the damage of each theft. But a full infostealer does not depend on the keyboard: it tries to dump the browser vault and steal session cookies, so use a corporate manager with an encrypted vault and automatic locking rather than the browser's built-in store without a master password. The effective combination is a password manager + passkeys where possible + EDR watching access to those stores.