Procedure examples

BISCUIT can capture keystrokes.

FakeM contains a keylogger module.

Revenge RAT has a plugin for keylogging.

MacMa can use Core Graphics Event Taps to intercept user keystrokes from any text input field and saves them to text files. Text input fields include Spotlight, Finder, Safari, Mail, Messages, and other apps that have text fields for passwords.

The FunnyDream Keyrecord component can capture keystrokes.

TinyZBot contains keylogger functionality.

Proton uses a keylogger to capture keystrokes.

NetTraveler contains a keylogger.

Lokibot has the ability to capture input on the compromised host via keylogging.

PoetRAT has used a Python tool named klog.exe for keylogging.

CHOPSTICK is capable of performing keylogging.

ZxShell has a feature to capture a remote computer's keystrokes using a keylogger.

BabyShark has a PowerShell-based remote administration ability that can implement a PowerShell or C# based keylogger.

njRAT is capable of logging keystrokes.

JPIN contains a custom keylogger.

metaMain has the ability to log keyboard events.

HTTPBrowser is capable of capturing keystrokes on victims.

Agent Tesla can log keystrokes on the victim’s machine.

ECCENTRICBANDWAGON can capture and store keystrokes.

When it first starts, BADNEWS spawns a new thread to log keystrokes.

DRYHOOK has captured user credentials and passwords in plaintext and has encrypted them in a stored file on the network device.

Remexi gathers and exfiltrates keystrokes from the machine.

Astaroth logs keystrokes from the victim's machine.

QakBot can capture keystrokes on a compromised host.

jRAT has the capability to log keystrokes from the victim’s machine, both offline and online.

The executable version of Helminth has a module to log keystrokes.

MacSpy captures keystrokes.

Dtrack’s dropper contains a keylogging executable.

ADVSTORESHELL can perform keylogging.

WarzoneRAT has the capability to install a live and offline keylogger, including through the use of the `GetAsyncKeyState` Windows API.

SLOTHFULMEDIA has a keylogging capability.

SILENTTRINITY has a keylogging capability.

PowerSploit's Get-Keystrokes Exfiltration module can log keystrokes.

DCRAT can log keystrokes on targeted systems.

Empire includes keylogging capabilities for Windows, Linux, and macOS systems.

PcShare has the ability to capture keystrokes.

PoshC2 has modules for keystroke logging and capturing credentials from spoofed Outlook authentication messages.

AsyncRAT can capture keystrokes on the victim’s machine.

Remcos has a command for keylogging.

Imminent Monitor has a keylogging module.

Pupy uses a keylogger to capture keystrokes it then sends back to the server after it is stopped.

QuasarRAT has a built-in keylogger.

Duqu can track key presses with a keylogger module.

RedCurl prompts the user for credentials through a Microsoft Outlook pop-up.

FIN4 has presented victims with spoofed Windows Authentication prompts to collect their credentials.

iKitten prompts the user for their credentials.

Cuckoo Stealer has captured passwords by prompting victims with a “macOS needs to access System Settings” GUI window.

Keydnap prompts the users for credentials.

Mispadu can monitor browser activity for online banking actions and display full-screen overlay images to block user access to the intended site or present additional data fields.

MuddyViper has displayed a fake Windows Security dialog to gather credentials.