Loading story…
Keyloggers are tools that record user keystrokes and are frequently used by threat actors for credential theft and cybercrime. They can be delivered via phishing, malicious downloads, or remote access, and are difficult to detect, especially in software form. Organizations should implement multi-factor authentication, robust vulnerability management, endpoint monitoring, and user awareness training to mitigate keylogger risks.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers exposed **KeyBase**, a low-cost commercial keylogger sold for about **$50** and used in widespread phishing campaigns against organizations worldwide, with notable targeting in the **high tech, higher education, and retail** sectors. Over a four-month period, analysts tracked **295 unique samples** across roughly **1,500 sessions** and linked the activity to about **50 command-and-control servers**. Written in **C#** on the **.NET Framework**, the malware supports keylogging, screenshot capture, clipboard theft, download-and-execute, persistence, and a kill timer. The malware’s command-and-control traffic used **unencrypted HTTP** with predictable requests and hardcoded paths, making network detection comparatively straightforward. Researchers also found major weaknesses in the operators’ own infrastructure, including **unauthenticated access** to stolen screenshots and an **arbitrary file upload** flaw in the web panel that could expose attacker credentials and allow unauthorized access to the management interface.
Aug 14, 2026
Researchers reported that the **KeyBase** credential-stealing trojan continued to spread widely even after its public takedown, with attackers distributing it through phishing emails and Office exploit kits. The malware steals browser and email passwords, logs keystrokes and clipboard data, captures screenshots, and uploads stolen information to a web management panel known as **Keypanel**. Analysis of exposed infrastructure found **82 active panels across 64 websites**, **933 infected Windows systems**, and **125,083 screenshots**, showing that operators were still actively collecting data from victims. The exposed screenshots and panel data revealed heavy targeting in **India, China, South Korea, the United Arab Emirates, Indonesia, Bangladesh, and Djibouti**, with manufacturing, transportation, hospitality, education, and business operations among the affected sectors. Researchers linked campaigns to phishing lures such as purchase orders and aviation-themed messages, and found evidence that attackers used embedded Nirsoft tools including `MailPassView` and `WebBrowserPassView`, stored in AES-encrypted form and unpacked at runtime, alongside obfuscated strings and compromised email accounts. The stolen material included banking activity, cargo and purchase-order details, hotel guest information, educational records, and other data consistent with credential theft, invoice fraud, and supply-chain compromise.
Aug 15, 2026
Threat actors have significantly escalated the use of information-stealing malware and credential theft techniques, leveraging new methods to bypass traditional security controls and exploit human vulnerabilities. Flashpoint reports an 800% increase in infostealer-driven credential theft in 2025, with over 1.8 billion accounts compromised globally. Attackers are neutralizing Windows' Mark of the Web (MotW) protections using drag-and-drop lures, exploiting vulnerabilities, and targeting alternative software to evade detection. The rise of session token theft is also enabling attackers to bypass multi-factor authentication (MFA), as tokens stored in browsers are increasingly targeted and sold on underground markets, often escaping detection by network-focused security tools. The evolving threat landscape is further complicated by the proliferation of infostealer malware, which has become a primary entry point for enterprise breaches. Security experts emphasize the need for organizations to look beyond malware signatures and focus on deceptive initial access vectors, such as malicious scripts, third-party supply chain risks, and user manipulation. Effective defense now requires monitoring browser behavior, treating client-side security as a core responsibility, and understanding the full identity attack surface to counteract these sophisticated evasion tactics.
Jun 29, 2026