Procedure examples

njRAT is capable of logging keystrokes.

JPIN contains a custom keylogger.

metaMain has the ability to log keyboard events.

HTTPBrowser is capable of capturing keystrokes on victims.

Agent Tesla can log keystrokes on the victim’s machine.

ECCENTRICBANDWAGON can capture and store keystrokes.

When it first starts, BADNEWS spawns a new thread to log keystrokes.

DRYHOOK has captured user credentials and passwords in plaintext and has encrypted them in a stored file on the network device.

Remexi gathers and exfiltrates keystrokes from the machine.

Astaroth logs keystrokes from the victim's machine.

QakBot can capture keystrokes on a compromised host.

jRAT has the capability to log keystrokes from the victim’s machine, both offline and online.

The executable version of Helminth has a module to log keystrokes.

MacSpy captures keystrokes.

Dtrack’s dropper contains a keylogging executable.

ADVSTORESHELL can perform keylogging.

WarzoneRAT has the capability to install a live and offline keylogger, including through the use of the `GetAsyncKeyState` Windows API.

SLOTHFULMEDIA has a keylogging capability.

SILENTTRINITY has a keylogging capability.

PowerSploit's Get-Keystrokes Exfiltration module can log keystrokes.

DCRAT can log keystrokes on targeted systems.

Empire includes keylogging capabilities for Windows, Linux, and macOS systems.

PcShare has the ability to capture keystrokes.

PoshC2 has modules for keystroke logging and capturing credentials from spoofed Outlook authentication messages.

AsyncRAT can capture keystrokes on the victim’s machine.

Remcos has a command for keylogging.

Imminent Monitor has a keylogging module.

Pupy uses a keylogger to capture keystrokes it then sends back to the server after it is stopped.

QuasarRAT has a built-in keylogger.

Duqu can track key presses with a keylogger module.

iKitten prompts the user for their credentials.

Cuckoo Stealer has captured passwords by prompting victims with a “macOS needs to access System Settings” GUI window.

Keydnap prompts the users for credentials.

Mispadu can monitor browser activity for online banking actions and display full-screen overlay images to block user access to the intended site or present additional data fields.

MuddyViper has displayed a fake Windows Security dialog to gather credentials.

Bundlore prompts the user for their credentials.

LP-Notes has displayed a fake Windows Security dialog box to prompt for Windows credentials.

Metamorfo has displayed fake forms on top of banking sites to intercept credentials from victims.

Calisto presents an input prompt asking for the user's login and password.

Proton prompts users for their credentials.

XCSSET prompts the user to input credentials using a native macOS dialog box leveraging the system process /Applications/Safari.app/Contents/MacOS/SafariForWebKitDevelopment.

Dok prompts the user for credentials.

SILENTTRINITY's `credphisher.py` module can prompt a current user for their credentials.

WARPWIRE can capture credentials submitted during the web logon process in order to access layer seven applications such as RDP.

The IceApple OWA credential logger can monitor for OWA authentication requests and log the credentials.

TrickBot has the ability to capture RDP credentials by capturing the CredEnumerateA API

RDFSNIFFER hooks several Win32 API functions to hijack elements of the remote system management user-interface.

NOKKI uses the Windows call SetWindowsHookEx and begins injecting it into every GUI process running on the victim's machine.

VersaMem hooked and overrided Versa's built-in authentication method, `setUserPassword`, to intercept plaintext credentials when submitted to the server.

Ursnif has hooked APIs to perform a wide variety of information theft, such as monitoring traffic from browsers.