{
  "family": "tspy",
  "sample_count": 22,
  "category": "trojan",
  "description": "TSpy (classified in antimalware research telemetry under designations including Spyware:Win32/TSpy, TrojanSpy:Win32/TSpy, and Trojan-Spy.Win32.TSpy) is a stealthy information-stealing trojan and surveillance threat. Designed to harvest sensitive enterprise and user credentials, TSpy is delivered via spearphishing attachments, malicious macros, and trojanized utility downloads. Upon execution, TSpy inspects the host environment for debugging tools and virtualization sandboxes before establishing persistence via registry run keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run. It deploys system-wide API hooks (such as SetWindowsHookEx) to log keystrokes, monitors active web browser windows (Chrome, Firefox, Edge) to intercept form data and session cookies, and extracts saved credentials from FTP clients and email software. TSpy bundles stolen telemetry into encrypted archives and transmits them to external command-and-control servers via HTTP POST requests.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Spyware:Win32/TSpy",
    "TrojanSpy:Win32/TSpy",
    "Trojan-Spy.Win32.TSpy",
    "Win32/TSpy",
    "Trojan.Spy.TSpy"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Spyware:Win32/TSpy?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "TSpy is a credential-stealing spyware trojan that captures keystrokes, browser passwords, and system information."
      }
    },
    {
      "@type": "Question",
      "name": "How does TSpy capture user keystrokes?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It establishes Windows API hooks using SetWindowsHookEx to monitor keyboard inputs across applications."
      }
    },
    {
      "@type": "Question",
      "name": "What credentials are targeted by TSpy?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It extracts cached passwords and session cookies from web browsers, email clients, and FTP management software."
      }
    },
    {
      "@type": "Question",
      "name": "How does TSpy exfiltrate gathered intelligence?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It compresses stolen credentials into encrypted archives and uploads them via HTTP POST requests to remote C2 servers."
      }
    },
    {
      "@type": "Question",
      "name": "What remediation steps should be taken following a TSpy compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the endpoint, terminate spyware processes, remove registry startup keys, reset all user credentials, and enable MFA."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1056.001",
    "T1555.003",
    "T1547.001",
    "T1071.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Spyware:Win32/TSpy",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Spyware:Win32/TSpy"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - TSPY Overview",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/tspy"
    },
    {
      "name": "Kaspersky Threat Intelligence Portal - Trojan-Spy.Win32.TSpy",
      "url": "https://threats.kaspersky.com/en/threat/Trojan-Spy.Win32.TSpy"
    }
  ],
  "mitre_attack_detail": [
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    },
    {
      "id": "T1555.003",
      "name": "Credentials from Password Stores: Credentials from Web Browsers",
      "tactic": "Credential Access"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    },
    {
      "id": "T1082",
      "name": "System Information Discovery",
      "tactic": "Discovery"
    }
  ],
  "containment_steps": [
    "Isolate the infected device from the network immediately to prevent further credential exfiltration.",
    "Kill active spyware processes and audit installed Windows API hooks.",
    "Remove Run keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run pointing to TSpy executables.",
    "Block outbound C2 IP addresses and exfiltration domains across network gateways.",
    "Force an immediate password reset for all user accounts, email profiles, and enterprise resources accessed from the host."
  ],
  "what_to_avoid": [
    "Do not enter passwords or login credentials on the infected workstation until verified completely disinfected.",
    "Do not delay credential revocation, as exfiltrated session cookies and passwords are functional immediately."
  ],
  "target_industries": [
    "Financial Services",
    "Healthcare",
    "Commercial Enterprises",
    "Government"
  ],
  "target_geographies": [
    "Global"
  ],
  "threat_actors": [
    "Information-Stealing Cybercrime Networks"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "credential_access",
    "collection",
    "exfiltration"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Credential Theft & Financial Espionage",
  "sample_hashes": [],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}