What is a keylogger?
A keylogger records what a user types and makes the record available to an attacker. Everything entered on the keyboard, including passwords, messages, search terms and card numbers, can be captured. Keyloggers come in two forms, software and hardware, and the difference decides how you find them.
Software keyloggers
A software keylogger is a program on the system. It intercepts keyboard input through the operating system, stores the keystrokes and sends them to the attacker on a schedule. Many also take screenshots or record clipboard contents, which captures passwords pasted from a password manager. Software keyloggers rarely arrive alone; they are commonly a feature of spyware, an infostealer or a remote access trojan delivered by a phishing attachment or a fake download. Because they are software, endpoint protection and EDR can detect them, and their activity shows up as unfamiliar processes and outbound connections.
Hardware keyloggers
A hardware keylogger is a physical device. The common type is a small inline adapter plugged between the keyboard cable and the computer's USB port, where it stores keystrokes in its own memory. Others are built into replacement keyboards or capture signals from wireless keyboards that do not encrypt their traffic. A hardware keylogger runs no software on the host, so antivirus and endpoint scans cannot see it. The attacker needs physical access to install it and often to retrieve it, although some models send their data over Wi-Fi.
A keylogger example
A finance user's account is compromised three times in a month. Each time, the password is reset and the endpoint scan comes back clean, yet the attacker signs in again within days. A technician checks behind the desktop and finds a small unknown adapter between the keyboard plug and the USB port. Repeated credential theft despite clean scans and password changes points to a hardware keylogger, and the fix is physical inspection.
How to defend against keyloggers
- MFA, ideally phishing-resistant, so a captured password alone cannot sign in.
- Endpoint protection and EDR, application allow lists and standard user accounts to stop software keyloggers.
- Physical security: locked offices, cable and port inspection, tamper-evident seals on shared or public machines and USB port controls.
- Password managers with autofill, which reduce how often passwords are typed.
- User awareness about unfamiliar devices attached to their computers.
Keylogger vs. spyware vs. shoulder surfing
A keylogger captures typed input specifically. Spyware is the broader category of covert data collection and often includes a keylogger. Shoulder surfing captures the same information by watching someone type in person, with no software or device involved. A RAT gives full remote control and may include a keylogger as one feature.
Keylogger on the CompTIA Security+ exam
Keyloggers are among the malware types in SY0-801 objective 2.5. The scenario clue is stolen typed input, such as passwords, chat messages or card numbers captured from a specific machine. If the theft continues despite password changes and clean endpoint scans, think hardware keylogger and physical inspection. Distractors include spyware (broader collection), RAT (full remote control), rootkit (hiding) and shoulder surfing. MFA is often the best answer for limiting the damage. The term also appears in A+ Core 2 (220-1202) objective 2.4.