Keylogger

A keylogger is software or hardware that covertly records what a person types — passwords, messages, payment card numbers, search queries — and delivers the log to an attacker. Keystroke capture is one of the oldest techniques in the intrusion playbook and remains a staple of modern infostealer malware, because it harvests credentials at the exact moment they are used, bypassing the protections that guard stored passwords.

How it works

Software keyloggers arrive the way most malware does: phishing attachments, cracked or fake software downloads, malicious ads, and drive-by installs. Once running, they hook keyboard input at the operating-system level, and modern variants rarely stop at keystrokes — commodity infostealers also grab clipboard contents, screenshots, browser-saved passwords, and session cookies, which can hand attackers a live login without any password at all (see session hijacking). Hardware keyloggers — small inline devices between keyboard and machine, or tampered peripherals — are rarer but effectively invisible to endpoint software, which keeps them relevant for physical intrusions. The harvested credentials are used directly for account takeover or sold in bulk; stolen logs from personal devices frequently include corporate passwords, which later resurface in credential stuffing campaigns and MFA bombing attacks against employers — a chain we trace in our MFA fatigue guide.

How to defend against it

• Cut off the delivery channels. Most corporate keylogger infections begin with a phishing message or an unauthorized download, so trained recognition — reinforced through phishing simulation — and restricted software installation do most of the preventive work.
• Assume some credentials will leak: phishing-resistant MFA (FIDO2, passkeys) and short session lifetimes turn a captured password into a much smaller prize.
• Watch the endpoints with EDR tooling that flags keyboard hooks, unusual data staging, and known infostealer families, and keep personal, unmanaged devices away from corporate logins.
• Address the personal-device gap. Employees who reuse a password that was captured at home hand attackers a corporate key; password managers plus unique credentials contain the blast radius.