{
  "family": "spytector",
  "sample_count": 0,
  "category": "infostealer",
  "description": "Spytector (cataloged across security vendors as MonitoringTool:Win32/Spytector, Spytector Keylogger, and Spytector.Delphi) is a sophisticated commercial-grade surveillance tool and stealth keylogger engineered in Delphi. Marketed as an undetectable monitoring utility, Spytector has been heavily repurposed by cybercriminals for unauthorized corporate espionage and credential theft. Upon execution, Spytector installs its payload silently, injects into legitimate Windows processes (such as explorer.exe), and establishes API hooks via SetWindowsHookEx to intercept all user keystrokes, clipboard modifications, opened application windows, and visited URLs. Additionally, Spytector extracts stored account credentials and cookies from major browsers, email clients, and instant messaging software. The harvested surveillance logs and screenshots are encrypted and automatically exfiltrated to threat actors via scheduled SMTP email dispatches or remote FTP server uploads.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Spytector Keylogger",
    "Spytector Surveillance",
    "Spytector.Delphi",
    "MonitoringTool:Win32/Spytector",
    "Trojan.Spytector"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Spytector surveillance tool?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Spytector is an advanced stealth keylogger and surveillance trojan designed to intercept keystrokes, capture screen activity, and extract stored credentials."
      }
    },
    {
      "@type": "Question",
      "name": "How does Spytector hook keystrokes invisibly?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Spytector injects code into legitimate system processes and leverages Windows API hooks like SetWindowsHookEx to record keyboard input."
      }
    },
    {
      "@type": "Question",
      "name": "How are stolen surveillance logs exfiltrated?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "The tool encrypts collected keystroke logs, screenshots, and credentials, then transmits them to attacker infrastructure via SMTP email or FTP."
      }
    },
    {
      "@type": "Question",
      "name": "Can Spytector bypass desktop firewalls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, by injecting into trusted processes such as web browsers or system utilities, Spytector tricks software firewalls into allowing outbound exfiltration traffic."
      }
    },
    {
      "@type": "Question",
      "name": "How can organizations detect Spytector?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Monitor for unauthorized API hooking behaviors, inspect outgoing SMTP/FTP traffic from workstation endpoints, and deploy behavioral EDR solutions."
      }
    }
  ],
  "faq_count": 5,
  "first_seen": 2006,
  "motivation": "Espionage",
  "lineage": {
    "derived_from": [
      "Delphi Keylogger Frameworks"
    ],
    "variants": [
      "Spytector 1.x",
      "Spytector 2.x",
      "Spytector Stealth",
      "Spytector.Delphi"
    ]
  },
  "exploited_cves": [],
  "mitre_attack": [
    "T1056.001",
    "T1113",
    "T1115",
    "T1555.003",
    "T1048.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "mitre_attack_detail": [
    {
      "id": "T1056.001",
      "name": "Keylogging",
      "tactic": "Collection"
    },
    {
      "id": "T1113",
      "name": "Screen Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1115",
      "name": "Clipboard Data",
      "tactic": "Collection"
    },
    {
      "id": "T1555.003",
      "name": "Credentials from Web Browsers",
      "tactic": "Credential Access"
    },
    {
      "id": "T1048.003",
      "name": "Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol",
      "tactic": "Exfiltration"
    }
  ],
  "containment_steps": [
    "Disconnect the affected computer from local networks to block outbound SMTP and FTP exfiltration.",
    "Use endpoint detection tools to unhook API interception routines and terminate injected explorer.exe threads.",
    "Delete Spytector persistence keys from the Windows registry.",
    "Rotate all corporate passwords, user credentials, and encryption keys entered on the host during the infection window."
  ],
  "what_to_avoid": [
    "Do not enter sensitive credentials or corporate passwords on systems showing signs of unauthorized process injection.",
    "Avoid installing untrusted monitoring or utility applications without corporate IT authorization."
  ],
  "iocs": {
    "file_hashes": [
      "5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e",
      "1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b"
    ],
    "delivery": [
      "Targeted spear-phishing emails containing trojanized PDF attachments or setup utilities",
      "Direct physical installation or remote desktop compromise by malicious insiders"
    ],
    "persistence": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\SpytectorServer",
      "HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - MonitoringTool:Win32/Spytector",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=MonitoringTool:Win32/Spytector"
    },
    {
      "name": "Spytector Official Research & Detection Dossier",
      "url": "https://www.spytector.com"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}