Keyloggers

Last reviewed: 2026-10-11 | Status: Draft (new topic; scripts tested against local lab targets, references not yet independently re-verified)

Standards mapping

What it is

A keylogger records what a user types so the attacker can collect passwords, messages and card numbers. Software keyloggers run on the victim's machine; hardware keyloggers sit between the keyboard and the computer.

How it works

Software keyloggers hook the operating system's input path: API hooks, kernel drivers, reading input devices directly, injecting code into browsers, or intercepting library calls. They store the keystrokes and send them to the attacker. Some also capture clipboard contents and screenshots.

Real-world example

The Zeus banking trojan family is a long-documented example of malware that captured credentials as users typed them into banking sites. Add a primary source when expanding this section.

Detection

• Processes holding keyboard devices (/dev/input/event*) open that are not the desktop's input stack
• LD_PRELOAD or a non-empty /etc/ld.so.preload (userland hooks)
• Known keylogger program names and input-hooking modules in running scripts
• Unexpected autostart entries, new kernel modules, outbound traffic from unusual processes

Prevention

In order of strength. The first items fix the cause; the rest reduce risk.

1. Use a password manager with autofill (nothing is typed, so there is nothing to log)
2. Use phishing-resistant MFA (passkeys, hardware keys) so a captured password is not enough
3. Keep systems patched and run endpoint protection; limit who can install drivers or load kernel modules
4. Application allow-listing
5. Inspect hardware: check the cable between keyboard and PC on shared or public machines

Scripts in this topic

• keylogger_detector.py: Linux indicator scanner

Common mistakes

• Believing on-screen keyboards stop all keyloggers (screen capture still works)
• Assuming no alerts means no keylogger: the scanner only finds indicators
• Removing a suspected keylogger without first changing passwords from a different, clean device

Test it safely

The scanner never records keystrokes. Test it by opening a harmless file under a fake --input-glob folder as shown in the project tests. Windows and macOS need different tooling (Sysinternals Autoruns and Process Explorer, or macOS Privacy settings under Input Monitoring).

References

• MITRE ATT&CK T1056.001
• CAPEC-568