Keyloggers: what seven sources say and where they differ

What a keylogger is, and when it is not a crime

The sources define it in slightly different words. Malwarebytes calls a keylogger a type of spyware that secretly records keystrokes, and adds that some also record screenshots, track visited websites, watch emails and instant messages, and reach a microphone or camera. Kaspersky’s blog says it is any software or hardware able to intercept and record input from the keyboard of a compromised machine, with the data kept on that computer or sent to a remote one. Sophos describes surveillance software or hardware that records every keystroke on a computer or mobile device and passes the data to a third party without the user’s knowledge. Microsoft lists what can be captured: passwords, card numbers, messages, emails and search queries.

Malwarebytes, Sophos, CrowdStrike, Microsoft and Kaspersky’s Resource Center also say that a keylogger is not always a crime, and this is where they stop agreeing. Malwarebytes names corporations, whose IT departments use them to troubleshoot or to watch employees, and parents, and it says that if whoever installs one actually owns the device, it is legal. CrowdStrike says keylogging is generally considered legal if you own the device, so you can monitor office computers if you own the business, but you cannot monitor a family member’s computer without their knowledge. Microsoft sets a stricter condition: legal when the person being monitored knows about it and gives permission, with employee monitoring, parental control, law enforcement with legal approval and corporate forensics as its examples. Kaspersky’s Resource Center goes the other way. It lists the owner, the manufacturer or a legal guardian as the people who can lawfully use one, says consent is notably absent from that list, and adds that users do not have to obtain it unless local law requires. The same page calls that ethically questionable where people are not told.

So three pages give three thresholds, and a reader who wants to know whether a particular case is legal will not get one answer from them. Microsoft also says laws differ between countries and regions and that organizations should consult legal counsel.

Kaspersky adds a point that matters for detection: because keylogger use runs from legitimate to criminal, security products may not label a discovered keylogger as an immediate threat, and the intent can be completely ambiguous, as with adware. Our page on adware covers the same difficulty from the advertising side.

Where the idea comes from, and who dates it when

Malwarebytes and Wikipedia both start in the mid-1970s, with a hardware device that Wikipedia calls the selectric bug. Soviet spies installed it in IBM Selectric typewriters in US embassy and consulate buildings, and it sent the typed characters by detecting magnetically the movement that rotates the print head. Wikipedia adds that Soviet embassies used manual typewriters for classified documents. Microsoft starts earlier: it says intelligence agencies used keylogging on typewriters and telex machines as early as the 1950s, that hardware keyloggers appeared in the 1970s, that software ones arrived with personal computers in the 1990s, originally for oversight and safety, and that by the 2000s they were common in malware delivered through phishing. Malwarebytes dates the boom in commercial products to the mid to late 1990s and says there are now thousands of different products in many languages. Wikipedia also records a keylogger program posted to a Usenet newsgroup on 17 November 1983. The earliest date is therefore Microsoft’s and the pages we read do not say what it rests on.

The two families, and the types inside them

Malwarebytes, Kaspersky, Sophos, Microsoft and CrowdStrike split keyloggers into software and hardware. Malwarebytes says software ones are far more common because they can be installed without physical access, and Kaspersky’s blog calls them “the most commonly used kind”, often installed as part of a larger piece of malware such as a trojan or rootkit. CrowdStrike says a hardware keylogger “isn’t as commonly used” because someone must reach the device, and Kaspersky’s blog calls them “less common” for the same reason.

Microsoft lists five kinds of software keylogger. API-based ones hook into operating system functions and are, it says, lightweight and hard to detect. Form grabbing captures what is typed into web forms before it is encrypted and sent. Kernel-based ones work at the core of the system, need elevated privileges to install and are described as highly stealthy; Kaspersky’s Resource Center adds that they get administrator-level permissions. JavaScript ones run in the browser and arrive through cross-site scripting or malicious ads. Remote access trojans give full control of a device and often include a keylogging function. CrowdStrike names form-grabbing, JavaScript and API keyloggers too, but describes form grabbing as typically deployed on a website rather than downloaded onto the victim’s computer, on a malicious site that prompts victims to enter their credentials, while Microsoft describes it as capturing information typed into web forms before it is encrypted and transmitted.

Hardware keyloggers get the most detail from Wikipedia’s page on them. A device needs a microcontroller and a non-volatile memory such as flash, which keeps the data when power is lost. Capacity ranges from a few kilobytes to several gigabytes, with each keystroke typically using a byte. Because it sits between the keyboard and the computer, it starts recording the moment the computer is switched on and can intercept passwords for the BIOS or for disk encryption software, and since it does not depend on the operating system, Wikipedia says software cannot detect it. The data is usually retrieved by typing a special password into a text editor. Wikipedia lists other forms too: BIOS-level firmware, wireless sniffers that collect packets from a wireless keyboard and try to crack the encryption, and keyboard overlays placed over a real keypad. It names one risk for the attacker: physical access is needed twice, to install and to retrieve, so a victim who finds one can set a trap.

Some methods touch nothing at all. Wikipedia describes acoustic keylogging, where each key makes a slightly different sound and statistical analysis maps sounds to letters, and says a long recording of 1000 or more keystrokes is required. It also reports researchers who captured keystrokes of nearby keyboards with the accelerometer of a smartphone on the same desk, with accuracy of as much as 80 percent, and says it is possible to capture the electromagnetic emissions of a wired keyboard from up to 20 metres away, adding that in 2009 Swiss researchers tested 11 different keyboards in a semi-anechoic chamber and found them all vulnerable. Sophos groups acoustic ones with visual ones that use hidden cameras.

On phones, Malwarebytes says it knows of no hardware keyloggers for mobile phones, but that Android and iPhone are still vulnerable to software ones that record which parts of the screen are touched. Microsoft’s platform section names Android specifically, where it says sideloaded apps, abuse of accessibility services and invisible screen overlays are the routes, and notes that macOS has required user consent for input monitoring since Catalina. For iOS, Microsoft says keylogging can still occur but mainly in rare, high-sophistication attacks, through jailbroken devices, misused enterprise apps distributed with developer certificates, and zero-day exploits in advanced spyware, while app sandboxing, limited API access and app review reduce the chance of a typical attempt. Our page on iPhone viruses covers what Apple’s design allows.

How one gets onto a device, and what travels with it

Malwarebytes says keyloggers install when you click on a file attachment you have been duped into opening, and that the attachment can come by email, text message, instant message, social network or an infected legitimate website that drops a drive-by download. Microsoft’s list is longer: phishing emails, malicious links and attachments, drive-by downloads, free or unofficial apps that carry one, physical access to place a hardware device, and remote access trojans that start the keylogger from a distance. Trend Micro adds macro-enabled Word documents, fileless techniques that run code in memory with PowerShell, trojanized or pirated software, and infected USB devices planted by attackers. It also names fake or compromised browser extensions, which it says can capture what is typed into web forms and get around password managers and virtual keyboards. Sophos names three routes: an email attachment, a compromised website download and physical installation. Kaspersky’s blog adds that some arrive inside a legitimate application download when the download channel or the application itself is compromised.

Malwarebytes says keyloggers rarely arrive alone: the same trojan that delivers one can slip adware, spyware, ransomware or a virus onto the system. Microsoft says they are often bundled with ransomware or remote access trojans. Our page on trojans explains the delivery side.

Two real cases show how differently the pages tell the same story. DarkHotel is described by Microsoft as keyloggers delivered over compromised hotel Wi-Fi to traveling executives, whose login credentials were stolen. CrowdStrike says hackers target unsecured hotel Wi-Fi and prompt users to download the software, and adds something Microsoft does not: after a certain number of recorded keystrokes, it says, DarkHotel deletes itself so that it cannot remain long enough to be detected. Microsoft also lists cases it does not name: a US construction company that lost money after a keylogger arrived by phishing and captured banking credentials, more than 200 retail locations infected with keylogging malware aimed at point-of-sale terminals, and laptops shipped with an audio driver that contained a keylogger built in for debugging. Microsoft names Emotet and TrickBot as malware with keylogging features that have targeted healthcare. The pages we read do not say how these cases were found, and CrowdStrike gives one reason a criminal wants one: to learn about a victim and write more convincing messages in a business email compromise.

Microsoft also lists who it sees at higher risk: remote workers, gamers who download cracked game files, students who download unlicensed software, small and medium-sized businesses, large enterprises, and executives and administrators.

Why you may not see one

CrowdStrike makes the first point plainly: unlike other malware, keylogging malware does not damage the computer or operating system, and the danger is what the attacker does with the personal information. Malwarebytes says the same about software keyloggers, which are not a threat to the systems they infect. A keylogger that does nothing visible has little to show.

Malwarebytes lists signs that poorer-quality ones might give: a slower browser, a lag in mouse movement or keystrokes, typed text not appearing on screen, error messages when loading pages, and worse smartphone screenshots. It then says the well-designed commercial grade usually works flawlessly, so it does not affect system performance at all, and that if one reports to a remote operator it disguises itself as normal files or traffic. Some can reinstall themselves if the user finds and removes them. CrowdStrike lists three signs: a slow browser, lag in the mouse and keystrokes, and a disappearing cursor. Microsoft lists sluggish performance, unexpected pop-ups or crashes, unusual network activity and antivirus alerts, and in another list repeated typos and delayed input. Sophos says that many enterprise-grade keyloggers show no visible signs at all, and Kaspersky’s Resource Center says keyloggers do not always cause noticeable problems. Malwarebytes, Sophos and Kaspersky agree that a missing symptom proves nothing.

Detection has two further problems. For custom keyloggers, those built for a specific attack, Kaspersky’s blog says they will not be recognized immediately as malicious, so they can be a difficult challenge for antimalware products, which can scan for, detect and remove known variants. For hardware ones, Kaspersky’s Resource Center says detection will likely be impossible without physical inspection, that security software probably will not find one, that an internal device needs a teardown, and that one built in by the manufacturer might mean a new device. Trend Micro says they are virtually undetectable through traditional antivirus. Wikipedia says visual inspection is the easiest way and that software techniques exist for most models.

CrowdStrike notes a trick for finding passwords quickly: an attacker can program a keylogger to react only to a particular character such as the at sign, so that it signals when an email address and password are probably being typed.

For manual checks, Microsoft lists the Task Manager or Activity Monitor for unfamiliar processes, the installed programs and browser extensions, outgoing network traffic, and the keyboard and USB connections. CrowdStrike lists the same tools but warns that hackers often make keyloggers look like legitimate programs, so it calls antivirus software the most reliable way to monitor for them. Our guide to telling whether a computer has a virus sorts such signs into events and measurements.

What to do when you suspect one

Of the seven sources we read, only Microsoft gives a full ordered sequence. It says to disconnect from Wi-Fi or unplug the Ethernet cable so the keylogger cannot send out stolen data, then run a full scan with a boot-time or offline scan if the software offers one, then change passwords on a secure device. In its words, do not change passwords on the infected device; use a clean device to update key accounts such as email, banking or work, and turn on multi-factor authentication if you can. Next come checking accounts for suspicious logins, transactions or messages, telling IT or a reputable cybersecurity support service, and, if the infection is severe or cannot be removed, a clean reinstall of the operating system after backing up only files confirmed to be clean. If customer, employee or financial information is exposed it adds reporting steps for organizations.

That password step is the one the other sources leave out. The pages from Malwarebytes, Kaspersky, Sophos and Trend Micro that we read do not say where to change passwords, and we did not find the reason for the advice spelled out in Microsoft’s page either. CrowdStrike gives a narrower version for public computers: consider changing your password when you can access your account from a private device, and use a single, frequently monitored credit card for purchases. Our guide to removing malware from a Windows computer covers the scan and clean-up part of the sequence.

Two other suggestions appear once. Kaspersky’s blog says that to get around a suspected keylogger you can boot the PC from a CD or USB drive, or use a virtual on-screen keyboard. Wikipedia says rebooting from a Live CD or write-protected Live USB is a possible countermeasure against software keyloggers if the disc is clean and the system on it is fully patched, and that booting a different operating system does not affect a hardware or BIOS-based keylogger.

The pages we read do not say how long a keylogger typically stays on a device before it is found, how to check an iPhone for one, or what a factory reset does on a phone or a Mac. For a Mac, Microsoft only names Activity Monitor for spotting unfamiliar processes.

What helps, and what only seems to

Multi-factor authentication. Microsoft, Sophos and Trend Micro all point to a second layer. Sophos puts it in terms of the temporary code: even with the password captured, the attacker cannot easily reach the account without it. Wikipedia states the limit that the others do not: one-time passwords may stop access with captured details because each is invalid once used, but an attacker with remote control of the computer can wait for the victim to sign in and then act during the open session.

The on-screen keyboard. Here the pages disagree. Microsoft says a virtual keyboard bypasses physical keystrokes, and Wikipedia says an on-screen keyboard will be effective against hardware keyloggers. Sophos answers the question about passwords typed on one with a yes: advanced software keyloggers can take rapid screenshots or use malicious API calls to record screen coordinates each time a virtual key is clicked. Trend Micro says malicious browser extensions can get around virtual keyboards. Kaspersky’s blog offers it as a way around a suspected keylogger without saying which types it stops.

A password manager. Microsoft says it autofills login credentials without typing, which can reduce exposure to keystroke logging, and that it helps stop phishing by filling only on legitimate sites. Trend Micro lists password managers among the protections that a fake browser extension can get around. Malwarebytes and CrowdStrike recommend long, unique passwords, which is a separate point.

Everyday habits. Updates are recommended by Malwarebytes, Kaspersky, Microsoft, Trend Micro and CrowdStrike. Malwarebytes also advises being skeptical of unexpected attachments and contacting the sender to ask. Kaspersky’s Resource Center advises against plugging in unknown USB drives and against leaving a device unattended, and CrowdStrike adds a firewall and avoiding passwords and card numbers on public computers. One definition worth keeping apart from these habits: Sophos separates a keylogger from spyware in a general sense, saying a keylogger records only inputs such as keystrokes and clicks, while spyware watches broader activity such as browsing history, downloads and location.