Keylogger

A keylogger, short for keystroke logger, is a program or physical device that secretly records what a person types on a keyboard or touchscreen. The record is then stored or sent to whoever installed it. Criminals use keyloggers to capture login details for online banking, payment card numbers, one-time codes and, in crypto, wallet passwords and recovery phrases.

Keyloggers are a form of surveillance tool and are often delivered as part of wider malware, such as banking trojans and information stealers. The same technology has lawful uses, including parental controls, workplace monitoring where the law allows it, and software testing, which is why possession alone is not always a crime. Whether a particular use is legal depends on consent and local privacy and computer-misuse laws.

Imagine someone standing quietly behind a person at a cash machine, writing down every button they press. A keylogger does the same job, but it hides inside the computer or phone, or sits between the keyboard and the computer, and it never gets tired. Everything typed, from emails to passwords, ends up in its notebook.

The person being watched usually has no idea. The computer keeps working normally, websites look the same, and the only sign may be money disappearing from an account weeks later. That is why security advice focuses on stopping the spy from getting in, and on making sure that a stolen password alone is not enough to open an account.

• Software keyloggers. Programs that hook into the operating system, the browser or individual apps to capture keystrokes. Some also take screenshots, copy the clipboard or grab whatever is entered into web forms before it is encrypted.
• Hardware keyloggers. Small devices plugged in between a keyboard and a computer, or built into a keyboard, that store keystrokes in memory. They need physical access but cannot be found by antivirus software.
• Overlay and skimming devices. Fake keypads and hidden cameras fitted to cash machines and payment terminals capture PINs, usually alongside the card skimming of magnetic stripe data.
• Mobile keyloggers. Malicious apps, or apps that abuse accessibility permissions, read what is typed on a phone's on-screen keyboard.

Most software keyloggers arrive through phishing emails, fake software downloads, pirated programs and malicious browser extensions. Once installed, they send captured data to a server controlled by the attacker. Banking trojans from the late 2000s onwards combined keylogging with form-grabbing to collect online banking credentials on a large scale, and the stolen details were then used for account takeover and fraudulent transfers, or sold on criminal forums for use in identity theft.

Crypto users are attractive targets because transfers are fast and usually cannot be reversed. A keylogger on a computer where someone types a seed phrase or private key gives the attacker full control of the wallet. Information-stealing malware often pairs keylogging with clipboard hijacking, which swaps a copied wallet address for the attacker's own at the moment of payment.

• Keeping software updated. Patching the operating system and browser closes many of the holes that keyloggers use to get in, and reputable security software can detect known strains.
• Using strong second factors. Two-factor authentication, especially hardware security keys or app-based prompts, means a stolen password alone is not enough. Codes sent by text message are weaker because of SIM swapping.
• Typing less. Password managers that fill in credentials automatically, and biometric logins, reduce the amount of sensitive text that passes through the keyboard.
• Keeping seed phrases off computers. A hardware wallet generates and stores keys on a separate device and asks the user to confirm transactions on its own screen, so a keylogger on the computer cannot capture the secret. Recovery phrases should never be typed into a website or connected device.
• Checking physical devices. Looking for unfamiliar adapters between keyboard and computer, and for loose or bulky parts on cash machines, catches hardware keyloggers and skimmers.

Banks and payment firms add their own layers, such as behavioural biometrics that notice when the typing rhythm on an account suddenly changes, and transaction monitoring that flags unusual payments.

In most countries, installing a keylogger on someone else's device without permission and using it to capture their data is an offence under computer-misuse, wiretapping or privacy laws, and using the captured data to take money adds fraud and theft charges. Employers that monitor work devices are generally expected to tell staff and limit monitoring to what is necessary, under data-protection rules such as the EU's General Data Protection Regulation. Selling keylogging tools explicitly designed for covert spying has also led to prosecutions in several jurisdictions.