A keylogger is software or a physical device that records what a person types, so that passwords, messages and card numbers can be read by someone else. Software keyloggers run on the computer, usually as part of wider malware such as an infostealer or remote access trojan; hardware keyloggers sit physically between the keyboard and the computer, or inside the keyboard itself. MITRE ATT&CK tracks the technique as T1056.001 Keylogging, under Input Capture. This guide explains how both kinds work at a level useful to defenders, what signals reveal them, and why phishing-resistant authentication makes captured passwords far less valuable. It is for endpoint, identity and SOC teams, with a short note for those handling lawful employee monitoring.
Key takeaways
- Keylogging is a credential theft technique first. ATT&CK notes adversaries use it to obtain credentials when credential dumping is not effective, often waiting a long time for a target to type the right password.
- Software and hardware keyloggers need different defences. Software keyloggers are an endpoint detection and application control problem; hardware keyloggers are a physical security and device inventory problem.
- Infostealers bundle keylogging with browser theft. The same malware that records keystrokes also lifts saved browser passwords (T1555.003) and session cookies, which is how credentials for the Snowflake customer intrusions were gathered.
- Passkeys and FIDO2 remove the typed secret. A keylogger can capture a password or one-time code, but not a private key held in an authenticator, so phishing-resistant MFA sharply limits what a keylogger yields.
- Monitoring software is legally constrained. Keystroke recording of staff by an employer is processing of personal data and needs a lawful basis, transparency and a proportionality assessment.
What it is
In plain language, a keylogger is a hidden recorder for a keyboard. Whatever is typed, including the password typed before the screen shows dots, is stored and later sent or collected. Some commercial products are sold for parental or workplace monitoring; criminal keyloggers are almost always a module inside larger malware rather than a standalone tool.
| Type | Where it sits | Needs admin or kernel access? | Main defence |
|---|---|---|---|
| User-mode software (API hooking or polling) | A process running as the user, registering for keyboard events through operating system interfaces | No, in many cases | EDR behavioural detection, application control |
| Kernel-mode software (custom driver) | A driver that reads input below the user session | Yes | Driver signing enforcement, vulnerable driver blocklist, memory integrity |
| Browser-based (malicious extension or injected script) | Inside a web page or extension, capturing form input | No | Extension allow lists, web application integrity controls |
| Hardware inline | A small adapter between keyboard cable and USB port | No (physical access) | Physical checks, USB device control |
| Hardware embedded or wireless | Inside the keyboard, or intercepting an unencrypted wireless keyboard signal | No (physical access or proximity) | Trusted procurement, encrypted wireless peripherals |
For the surrounding malware families, see the Malware Guide, the Infostealer Threat Guide and the Remote Access Trojans (RATs) Guide.
How it works
Software keyloggers
ATT&CK lists several ways software intercepts keystrokes: hooking the operating system callbacks that deliver keystroke data to applications, reading raw keystroke data from the hardware buffer, Windows Registry modifications, and custom drivers. On network devices, a modified system image can read keystrokes typed into login sessions. In general terms:
- Hooking and polling: the operating system offers legitimate interfaces for accessibility tools, hotkey utilities and remote support software to observe input. Malware registers for the same events or repeatedly asks for key state. Because legitimate software uses these interfaces too, detection depends on context: an unsigned process from a user's temp folder doing it is very different from a signed accessibility tool.
- Kernel drivers: a driver loaded into the kernel sees input before any user process. Loading one requires administrative rights and, on modern Windows, a signed driver, which is why attackers abuse legitimate but vulnerable signed drivers. Microsoft's recommended driver block rules address this, and they are enabled by default since the Windows 11 2022 update and enforced whenever memory integrity (HVCI), Smart App Control or S mode is on. See the Rootkits and Bootkits Guide.
- Form grabbing: many infostealers capture what is submitted in browser forms, or simply take saved passwords and cookies, rather than recording every key. The outcome for the defender is the same: the credential is gone.
- Exfiltration: captured text is buffered and sent periodically to a command server, a chat platform API or email, which is often the easiest point to detect.
Hardware keyloggers
A hardware keylogger needs physical access or proximity and leaves nothing for endpoint software to find, because it records signals before they reach the computer. The device is retrieved later or, in some models, transmits over Wi-Fi. ATT&CK's Hardware Additions technique (T1200) covers the related family of malicious peripherals, including devices that inject keystrokes rather than record them. Shared kiosks, reception desks, hot desks and executive offices with visitor access are the realistic exposure points. See the Physical Security Guide for Security Teams and the USB Drop Attacks Guide.
Why it matters
Keylogged and stolen credentials feed account takeover at scale. In the Snowflake customer intrusions of 2024, infostealers including VIDAR, RISEPRO, REDLINE, RACOON STEALER, LUMMA and METASTEALER captured credentials on systems not owned by Snowflake; at least 79.7% of accounts used had prior exposure in infostealer logs, some dating to November 2020, and the accounts had no MFA. About 165 organisations were notified. The lesson is not about one platform: any password that is typed on an infected machine should be assumed captured, and any account protected only by that password is exposed for as long as the password is valid.
What phishing-resistant authentication changes
| Authentication method | What a keylogger can capture | Residual risk |
|---|---|---|
| Password only | The password | Full account takeover until rotation |
| Password plus SMS or app one-time code | Password and the code as typed | Real-time relay of the code; CISA rates OTP and push as vulnerable to phishing and SMS as the weakest option |
| Password plus push with number matching | Password and displayed number | Reduced, but still phishable per CISA |
| FIDO2 security key or passkey | Possibly a device PIN, which is useless without the physical authenticator | Session cookie theft from the infected endpoint |
| Smart card (PKI) | The card PIN | Requires the card; session theft still possible |
The FIDO Alliance describes passkeys as public-key credentials bound to the site they were created for, with no shared secret for the user to type. CISA calls FIDO/WebAuthn the only widely available phishing-resistant authentication and advises starting with administrators, email, remote access and identity systems. The remaining gap is the session: malware on the endpoint can still steal the authenticated session cookie, so token binding, short session lifetimes and re-authentication for sensitive actions still matter. See the Passwordless and Passkeys Guide, the MFA Guide, the Phishing-Resistant MFA Guide and the Session Hijacking and Cookie Theft Guide.
Detection signals and rollout
| Signal | Source | Notes |
|---|---|---|
| Unsigned or rare process registering global keyboard hooks or polling key state | EDR behavioural telemetry | Baseline legitimate accessibility and remote support tools first |
| New kernel driver load, especially one on the vulnerable driver list | EDR, Windows Code Integrity events, App Control audit logs | Audit mode before enforcement |
| Small periodic outbound posts to chat or paste services from a user process | Proxy and DNS logs | Typical exfiltration of captured text |
| Unknown USB device between keyboard and host, or a new USB hub ID | Device control logs, physical inspection | Hardware loggers often present no device at all, so inspect |
| Corporate credentials appearing in infostealer logs | Threat intelligence feeds | Trigger forced reset and session revocation |
- Protect high-value accounts first: enrol administrators and remote access users in FIDO2 or passkeys, then extend to everyone.
- Harden endpoints: enable memory integrity and the vulnerable driver blocklist, and the attack surface reduction rule "Block abuse of exploited vulnerable signed drivers", in audit mode on a pilot ring, then enforce. Rollback is returning the affected ring to audit.
- Restrict execution: application control (ATT&CK M1038) and removal of local admin rights stop most user-installed loggers. See the Endpoint Privilege Management Guide.
- Control peripherals: limit hardware installation (M1034), use device control policies, and add a keyboard cable check to physical security rounds for shared and high-risk desks.
- Respond as a credential incident: when a keylogger is found, revoke sessions and reset every credential typed on that device since the earliest plausible infection date, including service and API credentials an administrator may have typed.
Useful KPIs: share of workforce accounts using phishing-resistant authentication; share of endpoints with memory integrity enabled; mean time from infostealer log alert to forced reset; number of unapproved kernel drivers blocked per month; percentage of shared workstations covered by physical inspection.
Common misconceptions
- "Antivirus finds keyloggers": many keylogging modules use interfaces legitimate software also uses, so detection relies on behaviour and context, not signatures alone.
- "Any MFA stops it": typed one-time codes can be captured and relayed in real time; only phishing-resistant methods remove the typed secret.
- "A password manager defeats keyloggers": autofill avoids typing site passwords, but the master password is typed, and infostealers target vaults and browser stores directly.
- "Hardware keyloggers are spy fiction": they are inexpensive and invisible to software; shared and public-facing machines are realistic targets.
- "Monitoring software is fine if staff signed a contract": in the UK, employer monitoring must comply with UK GDPR and the Data Protection Act 2018. The ICO's monitoring workers guidance is under review following the Data (Use and Access) Act, so check its current version; keystroke logging is highly intrusive and generally calls for a data protection impact assessment, clear notice and a demonstrable need. See the Insider Threat Programme Guide.
Related concepts
| Framework | Reference | Relevance to keyloggers |
|---|---|---|
| MITRE ATT&CK v20 | T1056 Input Capture, T1056.001 Keylogging, T1200 Hardware Additions, T1555.003 Credentials from Web Browsers, T1185 Browser Session Hijacking | The technique and its usual companions |
| ATT&CK mitigations | M1032 Multi-factor Authentication, M1038 Execution Prevention, M1040 Behavior Prevention on Endpoint, M1034 Limit Hardware Installation | Authentication, endpoint and peripheral controls |
| NIST SP 800-53 Rev. 5 | IA-2, SI-3, SI-4, CM-7, PE-3 | Authentication, malicious code protection, monitoring, least functionality, physical access |
| NIST CSF 2.0 | PR.AA-03, DE.CM-09 | Authentication of users and hardware, monitoring of endpoints |
| CIS Controls v8.1 | Control 6 (Access Control Management, including MFA), 10 (Malware Defenses), 2 (Software Inventory) | MFA, anti-malware, allowed software |
| ISO/IEC 27001:2022 Annex A | A.8.5 Secure authentication, A.8.7 Protection against malware, A.7.8 Equipment siting and protection | Policy-level controls |
Related reading: EDR Guide, Trojans Guide, Computer Worms Guide and Removable Media and USB Control Guide.
Practitioner checklist
- Prioritise passkeys or FIDO2 security keys for administrators, remote access and email, then the whole workforce.
- Enable memory integrity, the vulnerable driver blocklist and the vulnerable signed driver ASR rule, audit first.
- Remove standing local admin rights and enforce application control on user-writable paths.
- Tune EDR to flag rare processes capturing keyboard input, with a baseline of approved tools.
- Monitor egress for periodic small uploads to chat, paste and webhook services.
- Subscribe to infostealer log intelligence and automate forced reset plus session revocation.
- Add keyboard and cable inspection to physical rounds for kiosks, shared and executive desks.
- Treat any keylogger finding as a credential incident: reset everything typed on the device.
- Have legal and privacy review any employee monitoring tool before deployment.
Standards and references
- MITRE ATT&CK: Input Capture: Keylogging
- MITRE ATT&CK: Hardware Additions
- CISA: Implementing Phishing-Resistant MFA
- FIDO Alliance: Passkeys
- Microsoft Learn: Microsoft recommended driver block rules
- NIST: SP 800-53 Rev. 5
- ICO: Monitoring workers
Related NHI Mgmt Group resources: Infostealer Threat Guide · Passwordless and Passkeys Guide · MFA Guide · Malware Guide · Computer Worms Guide