What Is a Keylogger? How to Detect and Remove One

What is a keylogger? It is software or a small hardware device that secretly records what you type, so someone else can read your passwords, card numbers and messages. Software keyloggers usually arrive through phishing emails or unsafe downloads, while hardware keyloggers are physically attached to a computer. If you suspect one, stop signing in on that device, scan it, inspect the keyboard connection, and change your passwords from a different, clean device. This guide explains how keyloggers work, how to find and remove them, and how to prevent them, using FTC, CISA and MITRE guidance.

What Does a Keylogger Do?

A keylogger, short for keystroke logger, records keyboard activity. NIST says it "monitors and records keyboard use," and notes that some require the attacker to retrieve the data while others send it out by email, file transfer or similar means.

The goal is usually your logins. MITRE ATT&CK, the public catalog of attacker techniques, lists keylogging as technique T1056.001 and calls it the most prevalent type of input capture. Once someone has a password, they can reach the email, bank or work accounts behind it.

Not all keystroke logging is criminal. It can be legal when the person being monitored knows and agrees, as Microsoft explains. The trouble starts when it happens secretly on someone else's device.

Keylogger vs. spyware, stalkerware and infostealers

These terms overlap, and one piece of malware can fit several of them. Our guide to the types of malware covers the wider family.

Term	What it does	How it relates to keyloggers
Keylogger	Records what you type	Can be a program or a physical device
Spyware	Secretly gathers information from a device	Keylogging is one common spyware feature
Stalkerware	Spyware someone you know installs on your phone or computer	May read messages and location as well as typing
Infostealer	Grabs saved passwords, cookies and wallets in one sweep	Takes stored data; a keylogger waits for you to type
Remote access trojan	Gives an attacker remote control of a device	Many include a keylogging module

Our infostealer guide explains how stolen logins are packaged and sold, and our compromised credential statistics show the scale of the problem.

How a Keylogger Works

Most keyloggers follow the same three steps:

Capture. The keylogger copies each keystroke somewhere along the path from your keyboard to the app you are using.
Store. It saves the text in a hidden log, or in the memory of a physical device.
Deliver. Software keyloggers usually send the log out over the internet. Many hardware keyloggers must be collected in person, so whoever planted one may return.

The capture point decides which type you are dealing with and which check can find it.

Keystroke path from keyboard to website showing where hardware, kernel and form-grabbing keyloggers capture typing

Why HTTPS does not help. The padlock in your browser protects data on its way to the website. A keylogger on your device reads your typing before that encryption applies, so a secure website does not stop it.

Types of Keyloggers

Type	Where it sits	How it gets there	What finds it
Inline hardware	Between the keyboard and the USB port	Someone plugs it in	Looking at the connection
Keyboard-embedded hardware	Inside the keyboard	Tampering or a swapped keyboard	Replacing the keyboard; sometimes a close look
Wireless sniffer	Near a wireless keyboard, within radio range	Someone places it nearby	Noticing an unfamiliar device; using a wired keyboard
Kernel or driver software	Deep inside the operating system	Malware with high privileges	Offline scan, or a full reset
API or hook software	Listens to keyboard events	Phishing, bundled downloads	Security scan
Form grabber or browser script	Inside the browser or web page	Malicious extension or compromised page	Extension review; the site owner, for a compromised page
Mobile keyboard or accessibility app	Replaces the keyboard or watches text fields	A permission you, or someone else, approved	Permission review

Hardware keyloggers

A hardware keylogger does not rely on your operating system, so a software scan cannot see a separate physical device. It needs physical access, which makes shared and public computers and open offices the common settings. MITRE tracks this wider category as Hardware Additions (T1200).

Wireless keyboards can be targets too. In 2016, Help Net Security reported an FBI notice about KeySweeper, a device built to look like a working USB wall charger that could capture typing from certain wireless keyboards. The notice did not say when or where any had been found. The FBI suggested wired keyboards or wireless ones with strong encryption.

Software keyloggers

Software keyloggers are programs. MITRE lists several methods, including hooking keyboard functions and using custom drivers, and some work inside the browser, recording form entries before they are submitted. Many are not standalone tools. ATT&CK lists keylogging as a feature of remote access tools and stealers such as AsyncRAT and Agent Tesla, so finding a keylogger often means something broader is on the device.

Keyloggers on phones

Phones can be affected. MITRE's mobile entry (T1417.001) describes malicious apps posing as third-party keyboards, and on Android, apps abusing accessibility services to read typed text. Both routes need a permission that a person granted. On iPhone, Microsoft notes that jailbroken devices are especially exposed because they bypass Apple's built-in protections.

How Keyloggers Get on a Device

Phishing emails. A fake invoice or delivery notice carries a malicious attachment. In May 2025, the New Jersey Cybersecurity and Communications Integration Cell warned of 404 Keylogger, also known as Snake Keylogger, spreading through emails that impersonated a DHL shipment notice. DHL was being impersonated, not involved. Our guide to spear phishing shows how convincing these messages can get.
Unsafe downloads. Fake versions of real apps come from malicious sources, as CISA warns. Pirated and bundled software are common carriers.
Other malware. A trojan already on the device can install a keylogger later.
Physical access. Someone plugs in a device or installs an app while you are away.
Someone you know. Stalkerware is installed by someone with access to your device. The FTC notes it may hide behind innocent names such as "System Service."

Real Keylogger Cases

These cases come from court records and official sources.

Date	Setting	Type	What happened	Lesson
2001–2002	Copy shops, New York	Software	Keylogging software on public terminals collected customer logins, used to access or try to access bank accounts; 27-month sentence in 2005	Avoid sign-ins on public computers
March 2012	Cal State San Marcos	Hardware	Devices on 19 campus computers captured logins of nearly 750 students to rig a campus election; a year in prison	Shared computers need physical checks
March 2015–November 2016	University of Iowa	Hardware	Devices captured professors' logins, used to change grades; four months in prison and $67,900 restitution in 2018	Two-factor authentication would likely have stopped stolen passwords alone
2015	Ukrainian power companies	Software	The Sandworm group gathered credentials through a BlackEnergy keylogger plugin	Keylogging also appears in major attacks
February 2017–April 2018	Two New Jersey companies	Both	An intruder planted hardware keyloggers and software, then stole more than 15,000 files; 94 months in prison in 2020	Physical security is part of cybersecurity
December 2023–February 2024	Ivanti VPN appliances	Web script	Attackers altered a VPN login page's JavaScript to capture credentials	A clean device cannot help when the login page itself is compromised

Sources: the DOJ on the copy shop case, the FBI on the Cal State election case, the DOJ on the University of Iowa case with BleepingComputer's report on the missing two-factor authentication, MITRE ATT&CK for the Ukraine attack, the DOJ charging document and sentencing release for New Jersey, with the file count from Ars Technica, and MITRE's Cutting Edge campaign page.

Keylogging has a long history. In the 1970s, Soviet spies bugged IBM Selectric typewriters in US diplomatic buildings in Moscow.

Signs of a Keylogger

Many keyloggers show no signs at all, so a quiet device is not proof of a clean one. These signs can also have ordinary causes. The FTC lists these signs of malware:

Your computer slows down, freezes or crashes
Your browser's home page changes or you are redirected to other sites
New toolbars or add-ons appear
You see many pop-up ads or repeated error messages
Tools such as Task Manager or Activity Monitor are disabled
Emails or social media posts appear that you did not write

For phones, the FTC's stalkerware guidance adds faster battery drain, unexplained data use, overheating and unexpected restarts. It also points to a human sign: someone who knows your location, private conversations or browsing without being told, and who has had unsupervised access to your phone.

How to Detect a Keylogger

No single check finds every type, so combine them. A clean result is good news, not proof.

Matrix of six keylogger types against security scan, offline scan, permission review, hardware check and device reset

Keylogger type	Security scan	Offline scan	Permission review	Hardware check	Device reset
Malicious app or program	Often	Often	Sometimes	No	Often
Deep, hidden malware	Sometimes	Often	No	No	Sometimes
Malicious browser extension	Sometimes	Sometimes	Often	No	Often
Rogue phone keyboard or accessibility app	Sometimes	Not applicable	Often	No	Often
Inline USB device	No	No	No	Yes	No
Device hidden inside a keyboard	No	No	No	Sometimes	No

This matrix is DeepStrike's editorial guide to typical results, not a guarantee.

On Windows

Run a full scan in Windows Security, then run Microsoft Defender Offline. Go to Virus & threat protection, open the scan options and choose Microsoft Defender Antivirus (offline scan). It runs after a restart, before Windows loads, which gives persistent malware a harder time hiding. Save your work first. Results appear under Protection history.
Review Task Manager, your installed apps and your browser extensions for anything you do not recognize, as Microsoft suggests. An unfamiliar name is a reason to look closer, not proof of infection.

On Mac

Go to System Settings > Privacy & Security > Input Monitoring. Apple says apps listed here can monitor your keyboard, mouse or trackpad even while you use other apps. Turn off anything you do not recognize.
Check Accessibility in the same pane, since Microsoft notes that malicious apps may request accessibility access to watch keyboard input.
Review Activity Monitor and browser extensions, then run your security software.

On iPhone

Go to Settings > General > Keyboard > Keyboards and remove any keyboard you did not add.
On iOS 16 or later, use Safety Check in Settings > Privacy & Security to review who and what has access. Read the safety warning below first if someone you know may be involved.
The FTC suggests checking whether the phone was jailbroken, since some stalkerware depends on it.

On Android

Open the Play Store, tap your profile icon, then Play Protect. Google Play Protect checks apps and your device for harmful behavior.
Review your accessibility settings and keyboard list. Menu names vary by manufacturer. Be suspicious of a cleaner or utility app with accessibility access that you do not remember approving, which is the abuse route MITRE describes.
The FTC suggests checking whether the phone was rooted.

Checking the hardware

Microsoft's advice is to "look for anything odd between your keyboard and computer," and to check the keyboard itself, especially on public or shared devices. In practice:

Follow the keyboard cable to the port and look for a small adapter or extra plug you did not add.
At work, report unfamiliar devices or chargers instead of unplugging them yourself, because they may be evidence. The FBI's KeySweeper notice told office workers to watch for suspicious chargers.

How to Remove a Keylogger

Order matters, because changing a password on an infected device can hand over the new one. This sequence combines the FTC's malware steps with Microsoft's response checklist.

Six steps if you suspect a keylogger: safety, go offline, scan, check hardware, change passwords, reset if needed

Safety first if someone you know may be responsible. The FTC warns that removing stalkerware could make an abuser escalate and could tip them off. Talk to a domestic violence advocate from a device the person cannot access before you change anything. The National Domestic Violence Hotline is available at 1-800-799-7233. The FTC also advises documenting the abuse before you reset or replace the phone.

Go offline and stop signing in. Disconnect from the internet and stop shopping, banking and logging in on that device.
Update your security software and scan. Remove what it finds. On Windows, add the offline scan.
Check the hardware. Remove any device you did not add from a home computer, then restart and test. At work, call IT first.
Change your passwords from a clean device. Microsoft is direct: don't change them on the infected device. Then turn on two-factor authentication, as the FTC advises.
Check your accounts for unauthorized activity. Look at recent sign-ins, password changes and forwarding rules.
Reset the device if the problem continues or you cannot be sure. On Windows, Reset this PC reinstalls Windows and lets you keep your files or remove everything; apps and settings go either way. On a phone, a full factory reset may remove stalkerware, according to the FTC. Don't restore apps from a backup, since that could reinstall it; download them again from the app store. Google notes that a factory reset erases your data and that you will need your Google Account password afterward.
Get help and report it. The FTC suggests your device maker or a tech support company you know and trust. If your identity was misused, IdentityTheft.gov offers a free recovery plan, and the FTC also explains credit freezes and fraud alerts. Report cybercrime to the FBI's Internet Crime Complaint Center and suspicious emails or sites to ReportFraud.ftc.gov.

How to Prevent Keyloggers

Most of this list comes from CISA's spyware guidance:

Update your operating system and apps, and keep antivirus and anti-malware software installed.
Download only from official sources, such as your device's app store or the software's original site.
Review app permissions, especially keyboards, accessibility and input monitoring.
Be careful with attachments and links.
Use unique passwords and a password manager. Autofill means less typing, which Microsoft says can reduce exposure to keystroke logging.
Turn on multifactor authentication. A captured password alone then is not enough. CISA calls FIDO the only widely available phishing-resistant option, and our guide to how passkeys work explains why there is no password to type at all.
Keep physical control of your devices, and use a passcode.
Reboot weekly. CISA says powering off can clear some spyware.
Use caution on shared computers. The cases above show why.

On-screen keyboards can help against simple keystroke capture, but they are not a full fix. The Snake Keylogger alert notes that it also captures screenshots and clipboard data. Multifactor authentication has limits too, because stealers may grab session cookies, as our infostealer guide explains.

Are Keyloggers Legal?

It depends on who installs it, on whose device, and with what consent. This is general information, not legal advice.

Secretly recording someone else's typing can lead to serious charges. The cases above involved computer fraud and identity theft, and the federal Wiretap Act restricts intercepting electronic communications. Selling spyware carries risk too: in 2014, the Justice Department announced the first-ever criminal conviction for advertising and selling a mobile spyware app, and in 2021 the FTC moved to ban the maker of the SpyFone stalkerware apps from the surveillance business.

Employer monitoring rules vary by state and country, so organizations should disclose monitoring in policy and ask counsel first.

For Organizations: How to Detect and Test for Keyloggers

For a business, a keylogger is a credential-theft problem. MITRE says keylogging "cannot be easily mitigated with preventive controls" because it abuses normal system features. So plan to limit what a stolen password can do, and to detect the behavior:

Require phishing-resistant MFA for email, VPN, administrator and finance accounts. Our guide to MFA fatigue shows why weaker methods still get bypassed.
Tune endpoint detection to the behaviors in ATT&CK's detection strategy DET0089: background processes calling keyboard functions on Windows, non-system processes reading input devices on Linux, and unexpected input-event access on macOS.
Control hardware. MITRE's Limit Hardware Installation (M1034) blocks unknown accessories, and physical checks of shared workstations catch what software cannot.
Manage browser extensions and third-party keyboards. MITRE lists keyboard allow lists as a mobile mitigation.
Protect your own login and payment pages, since scripts can capture input on the server side. Our PCI DSS 6.4.3 and 11.6.1 guide covers script monitoring.

Then test it. On a non-production host, run an authorized emulation of T1056.001 and confirm that an alert fires and that someone responds. A social engineering penetration test measures whether staff open the lures that deliver keyloggers, while a red team exercise shows whether your team notices credential theft in progress.

DeepStrike's penetration testing services include social engineering simulations such as phishing, calling and baiting, and our red teaming services measure SOC, alerting and response workflows against realistic tradecraft. Testing shows where controls fail; it does not guarantee security. To scope a test, contact our team.

Frequently Asked Questions

Is a keylogger a virus?

Not strictly. A virus spreads by infecting files, while a keylogger's job is to record typing. NIST classes keystroke loggers as attacker tools that malware delivers. Security software usually treats them as malware anyway.

Can antivirus detect a keylogger?

It can often detect software keyloggers, and an offline scan helps with those that hide. It cannot see a separate hardware device, so check the connection too.

How do I know if I have a keylogger?

Often you can't tell from symptoms alone. Run a scan, review permissions and extensions, and inspect the keyboard connection.

Can a keylogger be removed?

Usually, yes. Scan with up-to-date security software, remove unknown hardware, change passwords from a clean device, and reset if you cannot be sure. If someone you know may be responsible, talk to an advocate first.

Key Takeaways

Most of the defense is simple: official downloads, updated software, a look at the cable, and multifactor authentication so a stolen password is not enough. If you suspect a keylogger, follow the steps in order and change your passwords from a clean device.

About The Author

Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.