A keylogger records what a person types, usually to capture passwords and other secrets. It may be software on the device or a small hardware device on the keyboard cable. Because it abuses normal system features, the best defenses are phishing resistant multi-factor authentication and detection by behavior.
How do keyloggers work?
MITRE ATT&CK describes keylogging as logging user keystrokes to intercept credentials as the user types them. Its entry says keylogging is likely used to acquire credentials for new access when credential dumping is not effective, and that it may require the adversary to intercept keystrokes for a substantial period before credentials are captured. To speed that up, an adversary may clear browser cookies to force users to sign in again.
On Windows, software can use keyboard hook or key state functions. ATT&CK's detection notes also describe processes reading input devices on Linux, and event taps on macOS requested by unexpected processes. On network devices, it mentions altered firmware or capture of console keystrokes. The technique appears in many documented malware families and intrusion campaigns listed in the entry, including the 2015 Ukraine electric power attack, where a keylogger plugin gathered credentials.
Why are they hard to prevent?
ATT&CK states plainly that this technique cannot be easily mitigated with preventive controls because it is based on the abuse of system features. The same functions legitimate accessibility tools, remote support software and games use are the ones a keylogger uses. A blanket block would break real software.
What actually limits the damage?
Multi-factor authentication. A keylogger captures what you type. If the password alone is not enough, the stolen password is worth less. A one time code typed in can be captured too, so prefer methods that cannot be typed or replayed, such as hardware security keys that bind the login to the real site, which ATT&CK also names as a mitigation for cookie theft.
Password managers. Autofill avoids typing the password and ties it to a site, though it is not a complete defense on a compromised machine.
Least privilege. Fewer users with admin rights means fewer places where an attacker can install system level hooks.
Application allow listing and updates. Keeping unknown software from running removes the install path. Patching removes the exploit path.
Physical checks. For hardware keyloggers, look at cable ends and USB ports on shared or public machines, and restrict who can plug devices into workstations.
How do you detect one?
Detection is behavioral. ATT&CK's analytics include watching for non-UI service processes using keyboard hook or polling functions along with registry or driver changes, non-system processes accessing input device files, unexpected processes installing event taps on macOS, and modified firmware on legacy network devices. Beyond that, look at outbound traffic from endpoints to unfamiliar destinations at regular intervals, which may be the log being sent out, and at new startup entries.
Endpoint security tools often carry these detections, but they work best with good inventory and logs. Treat a suspected keylogger as a credential incident: assume everything typed on the machine is exposed.
A constructed example
A finance employee's laptop picks up a trojan from a fake invoice attachment. It logs keystrokes for a week. The employee's password for the banking portal is captured. Because the bank requires a hardware security key, the attacker's login fails at the second step. The endpoint alerts on a process hooking keyboard input, the laptop is isolated, and the password is reset anyway.
How to check or apply this
- Require MFA, and prefer hardware or other phishing resistant methods for finance, admin and email accounts.
- Remove local admin rights from daily accounts.
- Use allow listing or controlled software installation where practical.
- Keep operating systems and applications patched.
- Alert on processes that hook keyboard input unexpectedly.
- Inspect shared and public workstations for unfamiliar USB devices.
- If you suspect a keylogger, isolate the device, rebuild it and reset every credential typed on it.
Quick check
Can antivirus find all keyloggers?
No. Some are custom or abuse legitimate features, and hardware keyloggers are invisible to software scanners. Layer MFA and behavior monitoring.
What should I do first if I find one?
Disconnect the device from the network, then reset passwords from a clean device, since everything typed on the infected one may be exposed.
Sources
Last reviewed: 18 October 2026.
