Keyboard logging is the capture of keystrokes entered on a device. It is usually done by malware, an implanted monitoring tool, or low-level system software that records typed input before it reaches the application, which can expose passwords, secrets, messages, and other sensitive data.
What keyboard logging is and how it works
Keyboard logging is a keystroke-capture technique that records what a user types before the input reaches the intended application. The capture point matters: logging can occur in malware, monitoring software, or at a low layer of the operating system or driver stack, which makes the activity difficult to notice from within the application itself.
Because it sits in the path of user input, keyboard logging can observe far more than passwords. It may collect search terms, chat messages, account recovery answers, one-time codes, and internal notes. That makes it a broad data-exposure mechanism rather than a narrow password-stealing trick.
Why keyboard logging is dangerous
Keyboard logging is dangerous because typed input often contains the very material that protects access or reveals business-sensitive information. Once keystrokes are captured, an attacker or operator can replay credentials, impersonate a user, or harvest confidential content without needing to defeat the application directly.
The danger is amplified when the logger runs with elevated trust, because security tools, remote support utilities, browser extensions, or low-level system components can all see input across multiple applications. In practice, the threat is not only theft of a password, but reuse of the captured input to move into email, cloud consoles, payment systems, or internal admin tools.
For detection and control mapping, see CIS Controls v8, which includes account protection, malware defence, logging, and access control practices relevant to this class of threat.
Common ways keyboard logging appears
Keyboard logging is often associated with malware, but the implementation range is wider. Some tools hook input APIs, some install kernel or driver components, and some operate through remote access features or endpoint monitoring agents. The technique is attractive because it can collect secrets at entry time, before encryption, form validation, or application-level monitoring can intervene.
It also appears in blended attacks. A keylogger may be installed after phishing, bundled with another payload, or used alongside screen capture and clipboard theft to reconstruct a fuller picture of user activity. In mature incident handling, the presence of logging is therefore treated as one indicator inside a broader compromise chain, not as a standalone event.
For a control-oriented view of authentication, system integrity, and audit logging, consult NIST SP 800-53 Rev 5 Security and Privacy Controls, and for adversary technique mapping, MITRE ATT&CK Enterprise Matrix is the relevant reference.
How organisations reduce exposure
Reducing keyboard logging exposure starts with limiting where sensitive input can be typed and who can install or tamper with endpoint software. Strong device hardening, application allowlisting, least privilege, and careful control of remote access tools all reduce the opportunity for a logger to persist unnoticed.
Where keystrokes may expose high-value secrets, organisations should also prefer phishing-resistant authentication and secret handling that avoids unnecessary typing. Password managers, hardware-backed authenticators, and copy-safe workflows reduce the amount of sensitive material exposed to the keyboard in the first place. For software teams, secure coding and endpoint protection should be paired with monitoring that can surface suspicious injection, driver activity, or abnormal process behaviour.
For broader defensive alignment, NIST Cybersecurity Framework 2.0 provides useful governance around protect, detect, respond, and recover, while NIST SP 800-63 Digital Identity Guidelines is relevant where captured keystrokes could expose authentication material.
Risk and Threat Considerations
Keyboard logging is a high-value compromise mechanism because it targets the moment users create secrets, approve actions, or disclose sensitive information. The main threat is not just credential theft, but silent capture of enough context to bypass account protections, impersonate users, or support follow-on intrusion.
Failure mechanism: The logger sits below or beside the application layer, so defenders may see normal user activity while the input stream itself is being copied or forwarded elsewhere. That makes it effective for persistent compromise, especially when installed by malware, bundled with remote administration tooling, or hidden inside low-level components.
Impact: Compromise can spread from a single endpoint into email, SaaS, admin consoles, internal systems, and any workflow where typed secrets or approvals are reused. The same capture channel can also expose business-sensitive messages and recovery answers, which increases both access risk and information leakage risk.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-5 — Account Management | Keyboard logging often targets account credentials and typed secrets. |
| Recommendation — Restrict and monitor accounts so captured credentials are less usable. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Typed secrets and authenticators are a primary keyboard-logging target. |
| AU-6 — Audit Review, Analysis, and Reporting | Detection depends on reviewing endpoint and access logs after compromise indicators appear. | |
| Recommendation — Reduce reliance on reusable secrets and rotate compromised authenticators promptly. Correlate endpoint and access telemetry to confirm abuse and scope exposure. | ||
| MITRE ATT&CK | T1056 — Input Capture | Keyboard logging is a direct implementation of input-capture tradecraft. |
| Recommendation — Map suspected keystroke capture to input-capture techniques and hunt for related payloads. | ||
| NIST CSF 2.0 | PR.AA-05 — Identity Management, Authentication, and Access Control | Captured keystrokes commonly expose authentication material and access paths. |
| Recommendation — Strengthen authentication paths so stolen typed secrets are less effective. | ||
Practitioner Guidance
Why practitioners should care: Keyboard logging is one of the clearest examples of why endpoint trust and identity trust have to be treated together. If a device can see every secret a user types, then protecting accounts only at the login screen is not enough.
What to watch for: Look for suspicious input hooks, unusual driver or accessibility components, unexplained remote support tools, and endpoint activity that does not match the approved software baseline. Where sensitive workflows are frequent, reassess whether users must type the secret at all.
Practitioner takeaway: The safest response is to reduce the amount of valuable input that ever reaches the keyboard, then assume any confirmed logger may require credential rotation, session review, and endpoint rebuild.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org