A keylogger is malware or monitoring software that records keystrokes entered on a device. Attackers use it to steal passwords, session data, and confidential input. Defenders look for unusual input hooks, suspicious processes, browser extensions, and outbound exfiltration, and reduce impact with MFA and least privilege.
What makes a keylogger dangerous
Keyloggers are dangerous because they capture the exact text a user types, which often includes passwords, recovery codes, session tokens, payment details, and sensitive business data. That makes them a direct route to account takeover and covert data theft, especially when the malware runs quietly in the background.
The core security problem is that keystrokes are high-value input, and a keylogger can defeat strong passwords if it observes them before they are protected by MFA or other downstream controls. In practice, the threat is not just stolen credentials, but the broader exposure of whatever a user types into authenticated sessions.
How keyloggers operate
Keyloggers may work by hooking input APIs, installing browser extensions, abusing accessibility features, or capturing keyboard events at a lower system layer. Some variants are standalone malware, while others are bundled into spyware, trojans, or infostealer families.
Because they rely on stealth, keyloggers often try to blend in with normal processes and avoid obvious crashes or prompts. That means defenders have to look for unusual hooks, unexpected startup entries, suspicious child processes, and outbound traffic that does not match the host’s normal behaviour.
Keylogging is not limited to physical keyboards. Software keyboards, remote desktops, and web forms can still leak typed content if the endpoint is already compromised or if malicious code has access to the input stream before encryption or submission.
What defenders look for
Detection usually starts with endpoint visibility, process inspection, and telemetry that can reveal suspicious persistence or capture activity. Correlating endpoint alerts with browser, network, and identity logs helps separate a noisy machine from an actual credential theft attempt.
Keylogger investigations also benefit from watching for secondary indicators such as unusual outbound connections, repeated access to password managers, or typed input followed quickly by anomalous login activity. A keylogger often leaves few direct traces, so defenders need to reason from behaviour as much as from the binary itself.
Post-compromise review should assume that anything typed on the affected device may have been exposed. That includes passwords, MFA backup codes, session cookies, and API keys entered manually into terminals or consoles. Where compromise is confirmed, rotate exposed secrets and invalidate active sessions rather than relying on password change alone.
For a broader view of malware patterns and detection trade-offs, Malware Guide is a useful companion reference.
Reducing exposure to keylogger compromise
The most effective mitigation is to reduce the value of what a user types and reduce the lifetime of anything captured. MFA, phishing-resistant authentication where possible, least privilege, and short-lived sessions all limit the payoff when keystrokes are stolen.
Hardened endpoints matter too. Restrict browser extensions, remove unnecessary admin rights, keep systems patched, and use application control where feasible so that malware has fewer ways to persist or intercept input. For environment-wide control baselines, NIST SP 800-53 Rev 5 Security and Privacy Controls provides a useful control catalogue for access control, logging, integrity, and configuration management.
Because keyloggers are often part of a wider malware chain, organisations should also review whether they can detect payload delivery, persistence, and credential theft behaviour together rather than as separate events. MITRE ATT&CK Enterprise Matrix helps map those behaviours to the techniques defenders hunt for, while NIST Privacy Framework can help structure thinking about sensitive input and data exposure.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Keylogger detection depends on reviewing endpoint and access logs for abnormal input and exfiltration patterns. |
| IA-5 — Authenticator Management | Keyloggers expose passwords, tokens, and other authenticators captured during user input. | |
| SI-3 — Malicious Code Protection | Keyloggers are a form of malicious code that must be detected and contained on endpoints. | |
| Recommendation — Correlate endpoint, authentication, and network logs to spot keystroke-capture and follow-on misuse. Limit authenticator exposure and rotate compromised secrets after suspected keylogging. Deploy anti-malware and execution controls to prevent or block keylogger installation. | ||
| MITRE ATT&CK | T1056.001 — Keylogging | ATT&CK defines keylogging as a credential-access technique used to capture user input. |
| Recommendation — Map detections and response playbooks to keylogging technique patterns. | ||
| NIST CSF 2.0 | DE.CM-01 — Monitoring for Anomalies and Events | Keyloggers surface through anomalous endpoint and network activity that requires continuous monitoring. |
| Recommendation — Monitor endpoints and outbound traffic for signs of input capture or data theft. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org