A keylogger is used to record keystrokes from a victim’s device and steal secrets as they are typed. Attackers use it to capture passwords, MFA recovery codes, internal commands and message content. Defenders should look for suspicious keyboard hooks, unusual accessibility abuse, endpoint alerts and account logins that follow typed secret entry.
How attackers turn a keylogger into a credential theft tool
Attackers use a keylogger to capture what a victim types before protective controls can stop it. That makes it useful for stealing passwords, MFA recovery codes, internal commands, chat content, and other secrets entered from a keyboard. In practice, the value of keylogging is less about the software itself and more about the access it gives to typed trust.
A keylogger is most effective when the attacker already has some foothold on the endpoint, because then the log can be collected quietly and used for later access. That is why defenders should treat keystroke capture as both a malware problem and an identity compromise problem, especially when typed secrets can unlock email, VPN, admin consoles, or internal tools. See the Malware Guide for the broader malware patterns that commonly carry this capability.
The attacker workflow usually follows a simple chain: infect the device, wait for high-value typing, extract the log, then reuse what was captured to log in elsewhere or escalate access. The most damaging outcome is often not the initial stolen password but the downstream reuse of that secret across sessions, systems, or administrative workflows. For real breach patterns involving stolen secrets and follow-on abuse, the LastPass breach 2022 shows how captured or exposed credentials can become a multiplier for later access.
Risk and Threat Considerations
Keyloggers are dangerous because they bypass many front-end defenses by stealing the secret at the moment it is entered. That can expose not only passwords but also one-time codes, session-related prompts, internal commands, and sensitive conversation content, which makes follow-on compromise much easier than a simple password reset suggests.
Failure mechanism: The attacker records keystrokes through malicious software, a browser or keyboard hook, or abuse of accessibility and input monitoring features, then uses the captured text to authenticate as the victim or to harvest additional secrets.
Impact: The result can be account takeover, lateral movement, access to internal systems, and unauthorized disclosure of data that was never intended to be stored in logs or chat history.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST SP 800-53 Rev 5, NIST SP 800-63 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1056.001 — Keylogging | Directly covers keystroke capture as an adversary technique. |
| Recommendation — Map alerts to T1056.001 and hunt for input-capture and credential-theft activity. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Keylogging investigations depend on endpoint and authentication evidence. |
| Recommendation — Correlate endpoint and authentication logs to spot keystroke-capture abuse. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Captured passwords and codes make credential lifecycle and rotation central. |
| SI-3 — Malicious Code Protection | Keyloggers are a malware delivery and detection problem on endpoints. | |
| Recommendation — Rotate exposed authenticators and revoke sessions after suspected keylogging. Detect and block keylogger payloads with endpoint malicious-code protections. | ||
| NIST SP 800-63 | 3.2.5 — Authentication Replay Resistance | Stolen typed secrets are most damaging when they can be replayed. |
| Recommendation — Prefer phishing-resistant authentication that limits replay of captured secrets. | ||
| NIST Zero Trust (SP 800-207) | 3.4 — Continuous Verification | Keylogging risk is reduced when access is re-evaluated instead of trusted after entry. |
| Recommendation — Continuously re-evaluate device and session trust after sensitive authentication. | ||
Practitioner Guidance
What to verify: Treat any alert about keyboard hooks, suspicious accessibility use, or unknown input-monitoring behavior as a signal to validate endpoint integrity first, not just the single account that was used. If the device is compromised, assume the attacker may already have collected multiple secrets, not just one password.
Decision rule: If the keylogger may have captured privileged credentials, MFA recovery material, or access to admin systems, prioritize rotation and session revocation before you rely on clean login evidence. A successful login after the fact does not prove the environment is safe if the attacker already harvested reusable secrets.
What to measure: Look for a mismatch between typed-secret entry and subsequent logins, unusual input-related endpoint telemetry, and new access from the same user that follows a suspicious keystroke-capture event. Those signals are often more useful than waiting for obvious malware symptoms.
Practitioner takeaway: The core question is not whether a keylogger can record text, it is whether that captured text can still unlock meaningful access. When it can, treat the event as a credential compromise until proven otherwise.