Procedure examples

Agent Tesla can log keystrokes on the victim’s machine.

ECCENTRICBANDWAGON can capture and store keystrokes.

When it first starts, BADNEWS spawns a new thread to log keystrokes.

DRYHOOK has captured user credentials and passwords in plaintext and has encrypted them in a stored file on the network device.

Remexi gathers and exfiltrates keystrokes from the machine.

Astaroth logs keystrokes from the victim's machine.

QakBot can capture keystrokes on a compromised host.

jRAT has the capability to log keystrokes from the victim’s machine, both offline and online.

The executable version of Helminth has a module to log keystrokes.

MacSpy captures keystrokes.

Dtrack’s dropper contains a keylogging executable.

ADVSTORESHELL can perform keylogging.

WarzoneRAT has the capability to install a live and offline keylogger, including through the use of the `GetAsyncKeyState` Windows API.

SLOTHFULMEDIA has a keylogging capability.

SILENTTRINITY has a keylogging capability.

PowerSploit's Get-Keystrokes Exfiltration module can log keystrokes.

DCRAT can log keystrokes on targeted systems.

Empire includes keylogging capabilities for Windows, Linux, and macOS systems.

PcShare has the ability to capture keystrokes.

PoshC2 has modules for keystroke logging and capturing credentials from spoofed Outlook authentication messages.

AsyncRAT can capture keystrokes on the victim’s machine.

Remcos has a command for keylogging.

Imminent Monitor has a keylogging module.

Pupy uses a keylogger to capture keystrokes it then sends back to the server after it is stopped.

QuasarRAT has a built-in keylogger.

Duqu can track key presses with a keylogger module.