Spyware & Keyloggers

Threat Landscape & Operational Overview

Spyware covertly monitors user behavior, communications, and system activities without authorization. Keyloggers, a core spyware subtype, record every keyboard stroke typed on the system—capturing confidential emails, personal messages, corporate trade secrets, and administrative passwords. Spyware also frequently captures screen snapshots, monitors clipboard data, and logs microphone audio, routing the stolen surveillance intelligence back to operator-controlled collection servers.

Primary MITRE ATT&CK Tactics & Techniques

Observed technical tradecraft, privilege escalation, and persistence patterns mapped across threat families in this category:

Actively Weaponized Exploits & Vulnerabilities (13 CVEs)

Adversaries deploying spyware & keyloggers frequently weaponize the following software vulnerabilities for initial ingress, privilege escalation, or lateral movement:

SOC Incident Containment Checklist

Standard operating triage procedure for security teams responding to suspicious or confirmed infections in this category:

1. Isolate the monitored workstation from the local network immediately.
2. Audit system keyboard drivers and user-mode global hooks for unauthorized hook procedures.
3. Inspect registry and startup locations for stealth logging applications.
4. Rotate all corporate passwords and user credentials accessed from the infected workstation from a known-clean device.
5. Enforce endpoint isolation and complete system re-imaging.

Prominent Malware Families in this Category

Top documented threats ranked by historical prevalence and behavioral signatures:

Complete Directory (11 Families)

Alphabetical index of all tracked malware families cataloged under spyware & keyloggers:

• candiru
• fearless_key_spy
• fearless_lite
• formbook
• freekeylogger
• hookey
• pegasus
• predator
• qqlogger
• relevantknowledge
• webwatcher