A keylogger records what a person types so an attacker can later steal passwords, messages, and other sensitive input from them.
It may be software hiding on the computer or a small device on the keyboard cable, and either form exposes whatever is typed.
How it works
The harm is a faithful copy of keystrokes, which can include passwords, one time codes, medical notes, and private messages as they are entered.
Because the capture happens at the keyboard, encrypting the network path does not hide the text from a logger that already sits on the endpoint.
This page describes the risk and the defenses, not how to build or hide such a recorder.
A second factor and a willingness to look for unexpected hardware reduce the value of a captured password even when typing was observed.
Concrete examples
- An employee discovers a tiny device plugged between the keyboard and the office computer after a visitor week.
- A laptop infection reports every banking password typed in a browser, including the characters of a one time code that was entered next.
- A shared reception desk computer records appointment notes that later appear in an extortion mail.
Protective measures
- Inspect unexpected adapters on shared desks and lock rooms where keyboards sit unattended.
- Use endpoint protection that can flag known logging software, and investigate alerts instead of dismissing them as noise.
- Prefer phishing resistant sign in for important systems so a captured password is not enough to enter.
- Teach people to pause when a machine starts behaving strangely after they have typed secrets into it.