What is a Keylogger? Types, and How to Detect It

Keylogger is a surveillance tool, either software or hardware, that secretly records every keystroke a person types on a device, capturing passwords, messages, and financial details as they are entered. It sits invisibly between the keyboard and the screen, which makes it a durable technique in the credential-theft playbook.

What a keylogger means in practice changed sharply. The standalone key-recorder of the past largely gave way to keylogging modules bundled inside modern information-stealing malware, which grab saved credentials and session cookies in bulk rather than waiting for a victim to type. This guide covers both the classic keylogger and its modern form, from how it works to how to detect, remove, and prevent it.

What Is a Keylogger

The name is short for keystroke logger, and what one captures reaches well beyond passwords. Depending on its sophistication, it records typed messages, search queries, and card numbers, while advanced variants add screenshots, clipboard contents, and the application each entry was typed into. Simpler tools store the log locally for the operator to collect by hand, and others transmit it to a remote server.

Keyloggers have a dual nature that shapes the whole topic. The same capability that lets a parent supervise a child's device or an employer monitor a company laptop lets a criminal steal banking logins. The tool itself is neutral, and the intent behind its use decides whether it is legitimate or an attack.

Types of Keyloggers

Two broad classes exist: software and hardware, and the software category splits further by the technique it uses to capture input. Each type trades stealth against how easily defenses detect it.

Form-grabbing and kernel-level variants trouble defenders in particular, since one bypasses encryption by reading data before the browser secures it, and the other operates below the layer most security tools watch.

How Keyloggers Work

A keylogger works in four stages, from capturing a keystroke to hiding its own presence. MITRE ATT&CK catalogs the core technique as Input Capture through keylogging, a method observed across espionage and credential-theft campaigns alike.

1. Intercept keystrokes. The keylogger hooks the input path and records each character, letter, number, or command into a buffer as the user types, running in the background without a visible window.
2. Store the data. Captured input is written to a hidden file or a block of memory, and advanced variants encrypt the log so scanning tools cannot read it if they find it.
3. Exfiltrate to the attacker. The tool sends its logs to a remote server on a schedule, through email, FTP, or a control panel, often encrypting the transfer to slip past perimeter inspection.
4. Conceal and persist. The keylogger renames its process, disables security features, and writes registry or startup entries so it survives reboots and evades casual inspection.

How Keyloggers Infect Devices

Software keyloggers reach a device through the same channels that deliver other malware, and modern credential-stealing malware sends its haul to the attacker immediately, and stealer logs often resurface for sale on dark-web markets and Telegram channels. Six vectors account for most infections.

• Phishing attachments: A malicious document or file disguised as an invoice or notice installs the keylogger when opened.
• Cracked and trojanized software: Pirated applications and fake installers from unofficial sites carry hidden keyloggers, a route attackers amplify with search-engine poisoning.
• Fake updates and ClickFix lures: Fraudulent browser-update prompts and fake verification pages trick users into running commands that download the malware directly into memory.
• Bundled freeware: Free programs from untrusted sources hide a keylogger in the installer, granted permission when the user clicks through prompts.
• Physical hardware installation: An insider or visitor plugs a hardware keylogger between the keyboard and the port, disguised as an ordinary adapter.
• Exploited vulnerabilities: Attackers exploit unpatched flaws in operating systems or applications to install a keylogger with no user action.

Keyloggers vs Infostealers: The Modern Shift

The standalone keylogger is no longer the main event. Keylogging survives mostly as one module inside broader malware such as Snake Keylogger and Agent Tesla, while stealers like RedLine skip keylogging altogether and harvest stored browser data in bulk. These families harvest saved passwords, autofill data, and session cookies from a browser in seconds rather than waiting for a victim to type them.

A keylogger and an infostealer differ in scope. A keylogger records what is typed, which catches credentials never saved to the browser, while an infostealer grabs everything already stored and exfiltrates it at once, then often self-deletes. Modern malware combines both, using keylogging to fill the gaps that stored-data theft leaves open.

Scale claims in this space deserve scrutiny. The widely reported 16 billion credential leak of June 2025 shows why scale claims deserve scrutiny. Security researchers found the dataset was largely recycled and partly fabricated, compiled from old infostealer logs and earlier breaches rather than a single fresh compromise.

A steadier signal sits underneath: a maturing stealer-log economy rather than one record-breaking dump.

The reason the shift matters for defenders is session-cookie theft. Stolen cookies represent an already-authenticated session. Replaying them lets an attacker enter an account without the password and without triggering multi-factor authentication, which turns a modern keylogger or stealer infection into an identity compromise rather than a simple password leak.

Real-World Keylogger Attack in 2026

A 2026 intrusion shows how little sophistication a keylogger needs to cause harm. A French-speaking attacker broke into a small French automotive business and planted a keylogger to capture what victims typed. Cato Networks reconstructed the 33-day operation command by command after the operator left his SSH keys and a step-by-step playbook in an open storage bucket, giving a rare view of a live keylogging campaign rather than its forensic aftermath.

The tool was deliberately crude: a 70-line Python keylogger that wrote keystrokes to a local file, which the attacker retrieved manually through his command-and-control server. What he took was narrow and valuable, banking logins, email passwords, and banking and email credentials. For a small business, that simple capture of typed secrets became direct financial exposure, a reminder that a keylogger needs no advanced tooling to do real damage.

Legitimate Uses and the Law: Are Keyloggers Illegal

Keyloggers occupy a legal gray area defined by consent and ownership rather than the technology itself. Legitimate uses include monitoring a device a person owns, employee monitoring where staff are clearly informed and have consented, parental supervision of a minor's device, and law-enforcement use authorized by a warrant.

The same tool becomes a crime when it is installed without consent to steal credentials, access accounts, or surveil someone. Unauthorized use breaches wiretap, computer-fraud, and privacy statutes in most jurisdictions, and undisclosed employee monitoring exposes an organization to liability. The deciding line is always whether the monitored party owns the device or has genuinely agreed to the monitoring.

Signs of a Keylogger Infection

Keyloggers are built for stealth, yet a software infection often leaves subtle traces. Six signs point to a possible keylogger.

1. Keyboard lag: A noticeable delay between pressing a key and seeing the character appear, as the logger intercepts each input.
2. Unexplained slowdowns: Sudden drops in performance or spikes in processor use with no obvious cause.
3. Unfamiliar processes: Unknown entries in the task manager or in startup items, sometimes disguised with system-like names.
4. Unexpected network traffic: Outbound connections to unknown servers, especially at odd hours, as logs are exfiltrated.
5. Unrecognized browser extensions: Add-ons that appeared without deliberate installation, a common home for form-grabbing loggers.
6. Credential-exposure alerts: Breach notifications or unexpected password-reset prompts, since the first evidence often appears externally rather than on the device.

How to Detect and Remove a Keylogger

Handling a suspected keylogger takes two phases: confirming the infection, then eliminating it completely so no hidden component restarts it.

Detecting a Keylogger

Detection combines on-device inspection with external monitoring. Reviewing running processes and startup items surfaces unfamiliar entries, a reputable anti-malware scan with rootkit detection catches most software loggers, and inspecting outbound network traffic reveals exfiltration to unknown servers. A physical check of keyboard cables and ports finds hardware devices, and continuous monitoring of stealer logs and leaked credentials can flag an infected machine even when nothing on the device looks wrong.

Removing a Keylogger

Removal starts with a full anti-malware scan, run in safe mode or from external boot media so the logger cannot protect itself. All passwords then need resetting from a separate, clean device, and active sessions and cookies need revoking, since stolen session tokens stay usable after a password change. Kernel-level infections that resist cleaning warrant a full operating-system reinstall to guarantee removal.

How to Protect Against Keyloggers

Prevention layers technical controls with careful habits, since keyloggers exploit both software gaps and human trust. Seven measures close the common paths.

1. Deploy endpoint detection and antivirus: Behavior-based endpoint tools flag the hooking and exfiltration patterns that signature scanning misses.
2. Patch systems promptly: Closing known vulnerabilities removes the openings that let a keylogger install without user action.
3. Use MFA and a password manager: A password manager autofills credentials rather than typing them, and multi-factor authentication limits the value of a stolen password.
4. Avoid cracked and unofficial software: Downloading only from trusted sources removes a common delivery route for bundled keyloggers.
5. Train against phishing: Recognizing malicious attachments, fake updates, and verification lures stops the infection before it starts.
6. Apply least privilege: Restricting administrative rights limits how deeply a keylogger embeds if it does run.
7. Inspect physical connections: Periodic checks of keyboard cables and USB ports catch hardware keyloggers in shared or public workspaces.

How CloudSEK XVigil Covers Leaked Credentials

Endpoint protection and training stop a keylogger on the device, yet modern credential-stealing malware exfiltrates its haul to dark-web markets and Telegram channels within hours, and the first sign of exposure often appears there rather than in local logs. Watching those markets is a defense the endpoint cannot provide.

CloudSEK XVigil monitors dark-web markets, criminal forums, and Telegram channels where stealer logs and leaked credentials change hands. It identifies employee machines that appear in infostealer logs, often the first sign an endpoint is infected, and validates whether leaked credentials still work, so teams act on live exposure rather than stale data. That window lets a security team isolate the infected device, reset passwords, and revoke the active sessions a stolen cookie would otherwise keep open. CloudSEK Threat Intelligence tracks which stealer and keylogger families are active against a given sector through its malware intelligence.

XVigil doesn’t run on the endpoint or remove the malware, which remains the job of endpoint protection. It covers the exposure that has already left the device, complementing on-device defenses rather than replacing them.

FAQs About Keyloggers

Are keyloggers illegal to use?

No, keyloggers are not inherently illegal to use. Running one on a device a person owns, or with clear consent, is legal. Installing a keylogger without consent to steal data breaks the law in most jurisdictions.

Can antivirus detect keyloggers?

Antivirus can detect most keyloggers, but not all. Updated tools catch known and commercial loggers, though kernel-level and freshly built variants often evade signature scanning and need behavior-based endpoint detection.

Can keyloggers affect mobile devices?

Yes, keyloggers can affect mobile devices. They reach phones through malicious apps and phishing links, capturing typed passwords and messages, and rooted or jailbroken devices face a higher risk.

How do you know if you have a keylogger?

You know you may have a keylogger from signs like keyboard lag, unexplained slowdowns, unfamiliar processes, unexpected network traffic, or a breach alert exposing credentials you never reported leaked.

Can a keylogger steal passwords?

Yes, a keylogger can steal passwords. It records each password as it is typed, and advanced variants also capture card numbers, messages, and the application where each entry was made.