Keylogger
Updated
A keylogger records keystrokes. Attackers can use malicious keylogging software or devices to capture credentials and other information entered on an affected system. Keylogging is one form of input capture; not all credential theft uses it, and not every authorized input-monitoring tool is malicious.
What do I need to know about Keylogger?
- Email can be the delivery route for a malicious attachment or a lure that persuades someone to install software.
- A password changed on a still-compromised device may be captured again.
- Captured input can include business information as well as login credentials, so scoping should consider what the user entered.
- Strong authentication helps protect accounts but does not remove malware from an endpoint.
An illustrative example
A user opens a purported supplier document and installs a “viewer.” Endpoint alerts later identify suspicious input capture. The response team treats the laptop and the accounts used on it as related investigations. It secures affected credentials from a trusted device rather than asking the user to keep changing them on the suspect laptop.
Practical checks
- Follow the endpoint-response process to isolate and assess the suspected device without destroying useful evidence.
- Establish the likely exposure period and identify important accounts or information used during it.
- Remediate the device, secure affected access from trusted systems, and review related sign-in activity.
Five FAQs about Keylogger
Can opening an email install a keylogger?
Risk depends on the software, vulnerabilities, and actions taken. Many lures require opening an attachment or installing something. Report what actually happened rather than assuming every opened message caused infection.
Does a keylogger only record passwords?
No. It may capture other typed information. The investigation should consider sensitive documents, messages, and services used during the suspected exposure window.
Will changing my password remove it?
No. Changing a credential does not remediate a compromised device. Coordinate endpoint cleanup and account containment, using a trusted system for sensitive recovery actions.
Can MFA help if a password is captured?
Yes, particularly stronger phishing-resistant methods, but endpoint compromise creates risks beyond password reuse. Do not treat MFA as a replacement for device investigation.
How can organizations reduce this risk?
Keep systems updated, restrict unnecessary software installation, use endpoint protection, and make suspicious-attachment reporting easy. Investigate requests to install unusual viewers or disable protective controls.
Sources and further reading
MITRE ATT&CK: Keylogging · Microsoft: Responding to a compromised email account
