Procedure examples

ThiefQuest uses the CGEventTap functions to perform keylogging.

Carbanak logs key strokes for configured processes and sends them back to the C2 server.

LODEINFO can capture keystrokes on targeted systems.

SMOKEDHAM can continuously capture keystrokes.

Metamorfo has a command to launch a keylogger and capture keystrokes on the victim’s machine.

Trojan.Karagany can capture keystrokes on a compromised host.

Bandook contains keylogging capabilities.

KONNI has the capability to perform keylogging.

gh0st RAT has a keylogger.

KGH_SPY can perform keylogging by polling the GetAsyncKeyState() function.

Micropsia has keylogging capabilities.

Catchamas collects keystrokes from the victim’s machine.

One of Attor's plugins can collect user credentials via capturing keystrokes and can capture keystrokes pressed within the window of the injected process.

NightClub can use a plugin for keylogging.

RTM can record keystrokes from both the keyboard and virtual keyboard.

Derusbi is capable of logging keystrokes.

Grandoreiro can log keystrokes on the victim's machine.

BadPatch has a keylogging capability.

XLoader can capture keystrokes from the victim machine.

MoonWind has a keylogger.

CorKLOG has captured keystrokes.

MgBot includes keylogger payloads focused on the QQ chat application.

OwaAuth captures and DES-encrypts credentials before writing the username and password to a log file, C:\log.txt.

Cadelspy has the ability to log keystrokes on the compromised host.

Cobalt Strike can track key presses with a keylogger module.

Cobian RAT has a feature to perform keylogging on the victim’s machine.

Unknown Logger is capable of recording keystrokes.

Kivars has the ability to initiate keylogging on the infected host.

PoisonIvy contains a keylogger.

NanoCore can perform keylogging on the victim’s machine.

TajMahal has the ability to capture keystrokes on an infected host.

Daserf can log keystrokes.

Cardinal RAT can log keystrokes.

BISCUIT can capture keystrokes.

FakeM contains a keylogger module.

Revenge RAT has a plugin for keylogging.

MacMa can use Core Graphics Event Taps to intercept user keystrokes from any text input field and saves them to text files. Text input fields include Spotlight, Finder, Safari, Mail, Messages, and other apps that have text fields for passwords.

The FunnyDream Keyrecord component can capture keystrokes.

TinyZBot contains keylogger functionality.

Proton uses a keylogger to capture keystrokes.

NetTraveler contains a keylogger.

Lokibot has the ability to capture input on the compromised host via keylogging.

PoetRAT has used a Python tool named klog.exe for keylogging.

CHOPSTICK is capable of performing keylogging.

ZxShell has a feature to capture a remote computer's keystrokes using a keylogger.

BabyShark has a PowerShell-based remote administration ability that can implement a PowerShell or C# based keylogger.

njRAT is capable of logging keystrokes.

JPIN contains a custom keylogger.

metaMain has the ability to log keyboard events.

HTTPBrowser is capable of capturing keystrokes on victims.