Loading story…
Elastic Security Labs detailed a Windows keylogging technique that abuses the RegisterHotKey API to register individual keys as global hotkeys and collect the resulting WM_HOTKEY messages. The Hotkeyz proof of concept temporarily unregisters a captured hotkey, replays the user’s original keystroke via keybd_event, re-registers the hotkey, and records its virtual-key code, allowing keystroke collection with little visible disruption.
The researchers found that Event Tracing for Windows does not produce telemetry for RegisterHotKey or UnregisterHotKey, limiting direct API-based detection. They instead created a kernel-driver-based detector that examines the undocumented gphkHashTable structure in win32kfull.sys for excessive alphanumeric hotkey registrations; registering 36 or more unmodified alphanumeric keys is identified as a likely indicator of hotkey-based keylogging. Elastic released the detector and demonstrated that it detects Hotkeyz.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Elastic Security Labs presented its research on detecting Windows hotkey-based keyloggers, including the kernel-memory inspection approach and Hotkeyz detection demonstration, at NULLCON Goa 2025.
Elastic Security Labs released a GitHub proof-of-concept detector that scans the undocumented win32kfull.sys gphkHashTable structure for broad individual alphanumeric hotkey registrations. The detector alerted on Hotkeyz using a threshold of 36 unmodified alphanumeric hotkeys.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
learn.microsoft.com
Open sourceelastic.co
Open sourcelearn.microsoft.com
Open sourcelearn.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Elastic added behavioral Windows keylogger detection to **Elastic Defend 8.12**, using Event Tracing for Windows (ETW) to observe API activity associated with keystroke collection through polling, keyboard hooks, Raw Input, and DirectInput. Prebuilt endpoint rules identify suspicious use of APIs including `GetAsyncKeyState`, `SetWindowsHookEx`, and `RegisterRawInputDevices`. In testing on Windows 10, Elastic Defend detected a proof-of-concept Raw Input keylogger soon after it executed, flagging an untrusted process that registered for keyboard input. The telemetry captures API arguments, call-stack context, process-signature status, and related process metadata, enabling defenders to investigate credential- and information-theft activity while reducing false positives from legitimate accessibility and input software.
Aug 27, 2026
Kaspersky detailed a Windows design flaw that allowed attackers to achieve boot-time kernel shellcode persistence on fully updated **Windows 7** and **Windows Server 2008 R2** by abusing insecure handling of registry data in legacy graphics drivers. The issue stems from use of `RtlQueryRegistryValues` with `RTL_QUERY_REGISTRY_DIRECT` and weak type validation, letting oversized `REG_BINARY` or `REG_SZ` values trigger stack buffer overflows where `REG_DWORD` data was expected in drivers including `dxgmms1.sys` and `dxgkrnl.sys`. Kaspersky said the weakness was tied to an incomplete fix for **CVE-2010-4398**, had been known for years, and was seen in a targeted attack in 2018, while Microsoft did not pursue further remediation because exploitation required administrator privileges. The attack chain used malicious values under `GraphicsDrivers` and `GraphicsDrivers\MemoryManager` to write shellcode to kernel memory at `0xfffff78000000800` and redirect execution there during boot. Kaspersky’s analysis of the recovered payload showed a second stage that injected into `vboxtray.exe`, loaded a reflective DLL named `keylogger.dll`, captured keystrokes with a `WH_KEYBOARD_LL` hook, encrypted the data with **RC4** using a key derived from the system `MachineGuid`, and exfiltrated the logs over **UDP port 53**. The company published the findings as part of a SAS CTF challenge walkthrough that reconstructed the full intrusion path from registry-based kernel persistence to user-mode keylogging and network exfiltration.
Jun 29, 2026
Multiple public research reports detailed how attackers can evade Windows security monitoring by abusing native APIs, loader behavior, and application logging. White Knight Labs and XPN documented techniques to suppress or bypass **Event Tracing for Windows (ETW)** visibility in .NET and Windows processes, while separate research showed that access-mask-based detections can be defeated with `DuplicateHandle` by first requesting only `PROCESS_DUP_HANDLE` and then cloning a more privileged handle to targets such as **LSASS** or **winlogon**. Microsoft documentation for `CreateProcessA` also appeared in the reference set because process creation remains central to many payload chains, including shellcode that ultimately launches command shells or follow-on tooling. Additional reports showed how attackers can blend execution into legitimate Windows behavior and trusted software. iPurple described **EntryPoint Hijacking**, in which a loaded DLL's entry point is overwritten so malicious code runs during normal thread creation or loader activity, reducing obvious injection signals and complicating EDR detection. NVISO separately analyzed Metasploit reverse-shell shellcode that walks the **PEB** and resolves APIs such as `LoadLibraryA`, networking functions, and `CreateProcessA`, while Hunt & Hackett showed that **ConnectWise Control/ScreenConnect** can be used for intrusion activity and that its own event logging can be disabled by patching `ScreenConnect.Core.dll`. Together, the reports underscore that defenders must validate loader integrity, monitor low-visibility handle requests and memory writes, and avoid relying on a single telemetry source such as ETW or application-generated event logs.
Aug 15, 2026