What is a Keylogger?

A keylogger captures keyboard input on a device. Criminal variants steal passwords, messages, payment and corporate data and commonly form one module of broader malware. Diagnostic, accessibility or monitoring software may use similar functions; lawful use depends on transparent purpose, consent and applicable law.

Which types of keylogger exist?

What data is captured?

Simple keyloggers record characters and active windows. Advanced infostealers add screenshots, clipboard, browser cookies, form data and context such as URL or process. On-screen keyboards do not stop every form because malware can observe clicks, screens or form values. Password managers reduce typing and generally do not fill on a false domain, but a compromised endpoint can steal authenticated sessions or submitted data.

How do keyloggers reach a device?

Common paths are malicious attachments, altered downloads, pirated software, browser extensions, exploited vulnerabilities and existing remote access. Hardware variants require physical or supply-chain access. High privileges and missing application controls facilitate deep persistence, but user-mode variants can collect valuable input without administrator access.

How are they detected?

• Endpoint protection detects known files, input hooks, suspicious drivers, persistence and process injection.
• Outbound connections and periodic small transfers to unknown destinations may indicate exfiltration.
• Unusual browser extensions, accessibility permissions, autostarts and keyboard apps require review.
• Physical inspection checks the USB and keyboard path, enclosures and unrecognized devices.
• Account theft continuing after a password change may mean input still occurs on a compromised device.

Performance issues and odd typing are not dependable indicators. Good keyloggers are unobtrusive, and a negative antivirus scan does not exclude compromise.

Which controls help?

1. Keep operating systems, browsers and applications current and install software only from controlled sources.
2. Restrict local administration, driver installation, macros and unapproved extensions.
3. Combine endpoint detection, application control and network monitoring.
4. Use password managers and phishing-resistant multi-factor authentication; these contain impact but do not clean an infected device.
5. Control devices physically and inventory peripherals, particularly in public or shared workspaces.

What should happen after discovery?

Isolate the device and do not use it for password changes. Preserve evidence and memory state according to incident procedure, investigate persistence and additional malware, and close the initial access path. Change every credential entered during the possible compromise from a clean device and revoke sessions, tokens and recovery codes. For hardware discoveries, inspect the access area, other workstations and likely duration.