{
  "family": "hookey",
  "sample_count": 17,
  "category": "spyware",
  "description": "Hookey (classified across security software as Spyware:Win32/Hookey, Trojan:Win32/Hookey, and Win32/Hookey) is a covert Windows keystroke logging and monitoring spyware utility. Distributed through malicious email attachments, Trojanized utility archives, and corporate spear-phishing payloads, Hookey is engineered for prolonged espionage and surveillance. Upon execution, Hookey installs a global Windows user hook via the SetWindowsHookExW API with WH_KEYBOARD_LL (low-level keyboard hook) and WH_MOUSE_LL flags. This allows Hookey to intercept all keystrokes, clipboard modifications, and mouse clicks before they reach target application windows. Hookey captures active window titles, timestamps, and entered text (including corporate passwords, private messages, and financial data), buffering logs into encrypted local cache files before exfiltrating them over SMTP email or encrypted HTTP POST to an attacker server.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Spyware:Win32/Hookey",
    "Trojan:Win32/Hookey",
    "Win32/Hookey",
    "Hookey Keylogger",
    "Spyware.Hookey"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Spyware:Win32/Hookey?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Hookey is a Windows keylogger and spyware utility that intercepts keystrokes, clipboard data, and application windows."
      }
    },
    {
      "@type": "Question",
      "name": "How does Hookey capture keystrokes on Windows?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It installs a low-level global keyboard hook using SetWindowsHookExW (WH_KEYBOARD_LL) to log keystrokes across all applications."
      }
    },
    {
      "@type": "Question",
      "name": "What sensitive information does Hookey target?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It captures login credentials, private chat messages, credit card numbers, and clipboard contents alongside active window titles."
      }
    },
    {
      "@type": "Question",
      "name": "How does Hookey exfiltrate stolen keystroke logs?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It encrypts collected log files and transmits them periodically via SMTP email or encrypted HTTP POST requests to attacker C2 servers."
      }
    },
    {
      "@type": "Question",
      "name": "How can organizations protect against Hookey spyware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Deploy endpoint security software that detects SetWindowsHookEx API hooking, restrict macro execution, and enforce multi-factor authentication."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1056.001",
    "T1115",
    "T1547.001",
    "T1082",
    "T1041"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2015,
  "threat_actor": null,
  "delivery_mechanism": [
    "Phishing Emails with Malicious Attachments",
    "Trojanized Utilities and Keygens",
    "Secondary Malware Loaders"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Low-Level Global Keyboard Hooking (WH_KEYBOARD_LL)",
    "Clipboard Monitoring & Content Capture",
    "Active Window Title Tracking & Timestamping",
    "Encrypted Local Keystroke Log Caching",
    "Exfiltration via SMTP Email or HTTP POST"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Outbound SMTP connections on ports 25, 465, or 587 transmitting encrypted log attachments",
      "HTTP POST requests transmitting base64-encoded keystroke buffers to external C2"
    ],
    "evasion_techniques": [
      "Obfuscating API calls to SetWindowsHookEx and GetAsyncKeyState",
      "Concealing encrypted log files inside hidden system directories with .dat or .tmp extensions"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "293a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a",
      "3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\HookeyMonitor"
    ],
    "file_paths": [
      "%AppData%\\Hookey\\hookey.exe",
      "%LocalAppData%\\Temp\\log.dat"
    ]
  },
  "defensive_measures": [
    "Deploy endpoint detection and response (EDR) rules alerting on processes installing global low-level keyboard hooks",
    "Implement multi-factor authentication (MFA) to minimize the impact of intercepted plain-text passwords",
    "Monitor network firewalls for unauthorized outbound SMTP traffic originating from desktop workstation subnets"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Spyware:Win32/Hookey",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Spyware:Win32/Hookey"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Spyware.Win32.Hookey",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Spyware:Win32/Hookey.A",
      "Trojan:Win32/Hookey.B"
    ]
  },
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence",
    "collection",
    "exfiltration"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Cyber Espionage & Keystroke Harvesting",
  "sample_hashes": []
}