Keylogger
A keylogger is malicious software that records which keys a user presses, typically to capture confidential information such as login or financial details and send it to an attacker. The practice is also called keystroke logging.
Updated
Overview
A keystroke logger monitors and records keyboard use. Some keyloggers keep the data on the host for the attacker to retrieve later, while others actively send it to another host by email, file transfer, or other means.
Attackers log keystrokes to intercept credentials as the user types them. MITRE ATT&CK lists keylogging as the most prevalent type of input capture and notes that it may need to run on a system for a substantial period before it captures credentials.
Keyloggers are often installed by other malware. NIST describes trojan horses that install keystroke loggers, and phishing attacks that install keystroke loggers or other attacker tools to gather additional personal information.
Because keylogging abuses system features, ATT&CK notes that preventive controls cannot easily mitigate it. Its detection guidance looks for behavior such as non-system processes reading keystroke buffers directly, or suspicious use of keyboard-related operating system calls in processes that have no user interface.
Similar Terms
2 termsSpyware
Spyware is the broader term for programs that collect information on a user's activities without their consent. A keylogger records keystrokes specifically, to capture details such as logins and financial information.
Phishing
Phishing uses deceptive messages and websites to trick people into disclosing sensitive information themselves. A keylogger captures that information as it is typed, and some phishing attacks install keyloggers to gather more of it.
Frequently Asked Questions
What does a keylogger do?→
A keylogger monitors and records keyboard use. The captured keystrokes can reveal confidential information such as passwords and financial details, which the keylogger stores for the attacker or sends to another host.
Can a keylogger steal passwords?→
Yes. ATT&CK describes keylogging as a way to intercept credentials as the user types them, and the ASD notes that keyloggers may be used to capture login or financial details and send them to an attacker.
How does a keylogger get onto a computer?→
Other malware often delivers keyloggers. NIST describes trojan horses that install keystroke loggers, and phishing attacks that install them to gather additional personal information.
Related
Tool categories
Career roles
Glossary terms
Sources
Definitions follow the government and standards body sources listed above. This site is not affiliated with the agencies or organizations cited.