{
  "family": "fearless_key_spy",
  "sample_count": 1500,
  "category": "spyware",
  "description": "Fearless Key Spy (cataloged across security software as Trojan-Spy.Win32.FearlessKeySpy and Spyware.Win32.Fearless) is a specialized Windows keystroke logger and commercial surveillance spyware tool developed in Borland Delphi during the mid-2000s cybercrime era. Engineered for covert background surveillance, Fearless Key Spy attaches a global low-level keyboard hook using the Win32 SetWindowsHookEx API. This enables the malware to intercept every keystroke entered across active applications, capture clipboard contents, and record foreground window titles alongside accurate system timestamps. Stored keystroke logs are encrypted and saved in hidden system directories before being periodically exfiltrated to attacker-controlled recipients via unauthenticated SMTP email messages or direct HTTP POST requests. Fearless Key Spy was distributed primarily through peer-to-peer file sharing networks, disguised as software cracks, key generators, and utility patches.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan-Spy.Win32.FearlessKeySpy",
    "Spyware.Win32.Fearless",
    "Trojan.Spy.FearlessKeySpy",
    "Win32/Fearless.Spyware"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Fearless Key Spy surveillance malware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Fearless Key Spy is a Delphi-based spyware and keylogger designed to intercept keystrokes, clipboard data, and window titles."
      }
    },
    {
      "@type": "Question",
      "name": "How does Fearless Key Spy capture typed keystrokes?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It registers a global Windows keyboard hook via the SetWindowsHookEx API to intercept all user keystroke events before apps process them."
      }
    },
    {
      "@type": "Question",
      "name": "How is captured surveillance data exfiltrated to attackers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Captured credentials and typed text logs are encrypted locally and exfiltrated via background SMTP email or HTTP POST requests."
      }
    },
    {
      "@type": "Question",
      "name": "Which CVE vulnerabilities have been linked to Fearless Key Spy delivery?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Campaigns delivering Fearless Key Spy droppers have leveraged common document and shortcut flaws including CVE-2010-2568 and CVE-2012-0158."
      }
    },
    {
      "@type": "Question",
      "name": "How can systems be safeguarded against Fearless Key Spy?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Implement endpoint privilege restrictions, deploy behavioral EDR monitoring for keyboard hook anomalies, and audit autostart Run keys."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1056.001",
    "T1115",
    "T1547.001",
    "T1041",
    "T1112"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Credential Access"
    },
    {
      "id": "T1115",
      "name": "Clipboard Data",
      "tactic": "Collection"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1041",
      "name": "Exfiltration Over C2 Channel",
      "tactic": "Exfiltration"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate compromised endpoints to prevent outgoing SMTP or HTTP credential exfiltration.",
    "Unhook malicious keyboard intercept hooks and terminate active Fearless Key Spy host processes.",
    "Purge persistence registry entries under HKLM and HKCU Software\\Microsoft\\Windows\\CurrentVersion\\Run.",
    "Reset all corporate passwords, user credentials, and security tokens exposed during the infection window."
  ],
  "what_to_avoid": [
    "Do not execute software cracks or key generators downloaded from peer-to-peer file-sharing networks.",
    "Avoid entering sensitive credentials on suspected compromised workstations prior to complete remediation."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "sources": [
    {
      "name": "Kaspersky Threat Intelligence - Trojan-Spy.Win32.FearlessKeySpy",
      "url": "https://threats.kaspersky.com/en/threat/Trojan-Spy.Win32.FearlessKeySpy/"
    },
    {
      "name": "Sophos Threat Center - Troj/Fearless-A Analysis",
      "url": "https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Fearless-A"
    },
    {
      "name": "NIST National Vulnerability Database - CVE-2012-0158",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-0158"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "execution"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "medium",
  "first_seen": 2004,
  "motivation": "Espionage",
  "lineage": {
    "derived_from": [
      "Delphi Keystroke Surveillance Frameworks"
    ],
    "variants": [
      "fearless_lite",
      "FearlessKeySpy.v2"
    ]
  },
  "exploited_cves": [
    "CVE-2010-2568",
    "CVE-2012-0158"
  ],
  "iocs": {
    "file_hashes": [
      "1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d",
      "e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1"
    ],
    "delivery": [
      "Peer-to-peer file sharing networks disguised as software cracks and game cheat tools",
      "Phishing emails with malicious Office attachments exploiting CVE-2012-0158"
    ],
    "persistence": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\FearlessKeySpy",
      "Hidden log file storage under %APPDATA%\\Fearless\\logs.dat"
    ]
  },
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}