{
  "family": "hawkeyekeylogger",
  "sample_count": 620,
  "category": "infostealer",
  "description": "HawkEye Keylogger (also tracked as HawkEye, HawkEye Reborn, and Spyware.HawkEye) is a commercial .NET surveillance toolkit and credential harvester sold on cybercrime forums since 2013. Marketed primarily to initial access brokers and business email compromise (BEC) operators, HawkEye is deployed via phishing emails bearing weaponized Microsoft Office documents, ISO image attachments, or archived executables. Once launched, HawkEye hooks Windows keyboard input APIs (such as SetWindowsHookEx) to log user keystrokes, capture clipboard data, and periodically screenshot active windows. It includes built-in extraction routines that harvest credentials from over 40 popular web browsers (Chrome, Edge, Firefox, Opera), email applications (Outlook, Thunderbird, Windows Live Mail), FTP clients (FileZilla, WinSCP), and gaming platforms. The malware exfiltrates stolen credentials and surveillance logs over encrypted SMTP, FTP, or directly to threat actor Telegram bot chats, allowing operators to rapidly hijack enterprise email accounts and execute fraudulent wire transfer schemes.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "HawkEye Keylogger",
    "HawkEye Reborn",
    "Trojan.HawkEye",
    "Spyware.HawkEye",
    "Win32/HawkEye"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is HawkEye Keylogger?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "HawkEye is a commercial .NET keylogger and information stealer that records keystrokes, screenshots, and stored browser/email passwords to execute Business Email Compromise (BEC) attacks."
      }
    },
    {
      "@type": "Question",
      "name": "How is HawkEye Keylogger delivered to victims?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "HawkEye is distributed primarily through phishing emails disguised as invoices, shipping documents, or purchase orders containing malicious Office attachments or ISO files."
      }
    },
    {
      "@type": "Question",
      "name": "How does HawkEye send stolen data to attackers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "HawkEye exfiltrates harvested keystrokes and credentials using hardcoded SMTP credentials to send email reports, FTP file uploads, or through Telegram Bot API HTTP requests."
      }
    },
    {
      "@type": "Question",
      "name": "What applications does HawkEye target for passwords?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "HawkEye targets saved passwords in Google Chrome, Microsoft Edge, Mozilla Firefox, Microsoft Outlook, Mozilla Thunderbird, FileZilla, and multiple instant messengers."
      }
    },
    {
      "@type": "Question",
      "name": "How can organizations protect against HawkEye Keylogger?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Protect against HawkEye by enforcing email gateway scanning for suspicious ISO/ZIP attachments, blocking outbound SMTP/FTP from user workstations, and deploying endpoint detection for API hooking."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1056.001",
    "T1555.003",
    "T1113",
    "T1115",
    "T1071.003",
    "T1547.001",
    "T1082",
    "T1041"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1056.001",
      "name": "Keylogging",
      "tactic": "credential-access"
    },
    {
      "id": "T1555.003",
      "name": "Credentials from Web Browsers",
      "tactic": "credential-access"
    },
    {
      "id": "T1113",
      "name": "Screen Capture",
      "tactic": "collection"
    },
    {
      "id": "T1115",
      "name": "Clipboard Data",
      "tactic": "collection"
    },
    {
      "id": "T1071.003",
      "name": "Mail Protocols",
      "tactic": "command-and-control"
    },
    {
      "id": "T1547.001",
      "name": "Registry Run Keys / Startup Folder",
      "tactic": "persistence"
    },
    {
      "id": "T1082",
      "name": "System Information Discovery",
      "tactic": "discovery"
    },
    {
      "id": "T1041",
      "name": "Exfiltration Over C2 Channel",
      "tactic": "exfiltration"
    }
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-16",
  "first_seen": 2013,
  "lineage": {
    "derived_from": [
      "hawkeye original commercial build"
    ],
    "variants": [
      "hawkeye v8",
      "hawkeye reborn",
      "hawkeye telegram edition"
    ]
  },
  "attribution": [
    {
      "actor": "Cybercrime BEC Syndicates",
      "confidence": "high"
    }
  ],
  "exploited_cves": [],
  "c2_profile": {
    "protocols": [
      "SMTP",
      "FTP",
      "HTTPS"
    ],
    "ports": [
      25,
      587,
      21,
      443
    ],
    "traffic_identifiability": "medium"
  },
  "iocs": {
    "file_hashes": [
      "c1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2",
      "d2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3"
    ],
    "delivery": [
      "phishing_emails",
      "iso_disk_images",
      "malicious_office_attachments"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run"
    ]
  },
  "sources": [
    {
      "name": "Trend Micro Security: HawkEye Credential Stealer Evolution",
      "url": "https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/hawkeye-credential-stealer-reborn"
    },
    {
      "name": "Cisco Talos Threat Spotlight: HawkEye Stealer Campaigns",
      "url": "https://blog.talosintelligence.com/hawkeye-reborn/"
    },
    {
      "name": "Malwarebytes Labs: Threat Analysis on HawkEye Keylogger",
      "url": "https://www.malwarebytes.com/blog/threat-spotlight/2020/02/hawkeye-keylogger"
    }
  ],
  "containment_steps": [
    "Terminate active .NET payloads and inspect processes hooking low-level keyboard messages via SetWindowsHookEx.",
    "Remove persistence keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run.",
    "Block outbound SMTP ports (25, 465, 587) and FTP port 21 from general workstation subnets at the perimeter firewall.",
    "Immediately rotate corporate email account passwords and invalidate session tokens to thwart BEC fraud."
  ],
  "what_to_avoid": [
    "Do not allow workstations direct outbound email transmission capabilities without traversing authenticated corporate mail relays.",
    "Avoid opening unverified ISO, VHD, or compressed archive files attached to unsolicited vendor invoices.",
    "Never store unencrypted administrative credentials inside web browsers or FTP clients."
  ],
  "target_industries": [
    "manufacturing",
    "logistics",
    "construction",
    "financial_services",
    "healthcare"
  ],
  "motivation": "Credential Theft & Business Email Compromise (BEC) Wire Fraud",
  "threat_actors": [
    "BEC Fraud Actors",
    "Initial Access Brokers"
  ],
  "target_geographies": [
    "GLOBAL",
    "US",
    "GB",
    "DE",
    "IT",
    "ES",
    "AU"
  ],
  "attack_stage": [
    "initial-access",
    "execution",
    "persistence",
    "credential-access",
    "collection",
    "exfiltration"
  ],
  "ecosystem": [
    "windows"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}