What Is a Keylogger? How Keylogger Spyware Works

A keylogger is software or hardware that secretly records every key you press on a keyboard, and sometimes your screen, clipboard, and location too, so that someone else can read it later. Criminals use keyloggers mainly to steal passwords, banking details, and other sensitive text the moment you type it, before encryption on a website or app ever has a chance to protect it. Some keyloggers are legitimate tools used by employers, parents, or researchers, but the versions that matter for most people are the ones installed without consent through phishing links, malicious downloads, or brief physical access to a device.

How a keylogger works

At its core, a keylogger sits between your fingers and the screen. Software versions intercept the signal a key press generates before, during, or after the operating system processes it, then write that data to a hidden log file or send it over the network to an attacker. According to Wikipedia's overview of keystroke logging, the practice itself is neutral; it is used legitimately for usability research, employee monitoring disclosed in a workplace policy, and parental controls, as well as maliciously for credential theft. The National Institute of Standards and Technology describes a closely related concept, keystroke monitoring, in NIST SP 800-12 Rev. 1 as "the process used to view or record both the keystrokes entered by a computer user and the computer's response," noting it is typically treated as a special case of audit trails. That framing matters: a keylogger is fundamentally an audit tool pointed at you instead of by you.

Beyond raw key presses, many modern keyloggers add features such as clipboard logging, periodic screenshots, recording which websites or apps were active, and on phones, access to call logs, GPS location, or camera and microphone data, according to security-vendor research from Kaspersky's keylogger resource page. That extra data makes a successful keylogger infection far more damaging than a single leaked password.

Hardware keyloggers vs. software keyloggers

The two categories differ in where they live and how they get onto a device, which changes how you detect and remove each one.

Software keyloggers are programs. Wikipedia's keystroke-logging article breaks them into several technical approaches, including API-based loggers that hook into keyboard-handling functions inside the operating system, form-grabbing malware that copies what you type into a web form the instant you hit submit, kernel-level loggers that run with the same privileges as the operating system itself (making them far harder to detect and remove), and JavaScript-based loggers injected into a compromised web page. The banking trojans Zeus and SpyEye reportedly used a related technique, injecting code into browser memory, to capture form data directly. Hardware keyloggers, by contrast, need no software at all. Wikipedia and vendor researchers both describe small inline adapters placed between a keyboard and a computer, modified keyboards with a logging chip built in, and even side-channel techniques such as analyzing the sound of keystrokes or electromagnetic emissions from a wired keyboard.

Is a keylogger a virus, malware, or something else?

A keylogger is best described as a form of spyware, a category of malware built to monitor and collect information without the user's knowledge, rather than a self-replicating "virus" in the strict technical sense. Malwarebytes classifies keyloggers specifically as spyware and notes that a malicious keylogger is typically bundled with other malicious code, such as a trojan, adware, or even ransomware, and delivered through the same channels those threats use. That said, people searching for "keylogger virus" are usually describing the same thing in everyday language: unwanted, hidden software that got onto a device without permission and is now watching what gets typed. Whether it is labeled spyware, a trojan component, or loosely called a virus, the practical risk and the response are the same.

How keyloggers get installed

Software keyloggers almost always ride in on a more familiar threat. The three most common paths are:

• Phishing. A malicious link or attachment in an email or text message installs the keylogger when opened. The FTC's phishing guidance notes that scam messages typically impersonate a company you already do business with and pressure you to click quickly, which is exactly the moment a keylogger payload gets dropped. Phishing-delivered spyware is also a common opening move in business email compromise schemes, where stolen credentials are used to redirect payments or impersonate executives.
• Malicious or bundled downloads. Cracked software, fake browser extensions, and "free" tools from untrusted sites frequently carry a hidden keylogger alongside the program you meant to install. CrowdStrike's threat research notes that drive-by downloads and trojanized software are among the most common infection routes for this reason.
• Physical access. Even a minute of unsupervised access to an unlocked computer is enough to plug in a hardware keylogger or install software manually. This is the one path that works against air-gapped or offline systems, and it is why shared or public computers carry extra risk.

Longer-running intrusions follow a similar pattern at a larger scale. Groups that maintain persistent, stealthy access to a target's network, the behavior covered in our explainer on advanced persistent threats, often deploy keylogging components as one piece of a broader toolkit used to harvest credentials over weeks or months rather than in a single smash-and-grab attempt.

Warning signs of a keylogger on a computer

Well-built keyloggers are designed to be invisible, so there is no guaranteed symptom. Still, vendor guidance points to a consistent set of possible indicators:

• Noticeable lag between pressing a key and seeing the character appear, or a cursor that occasionally disappears or stutters.
• Unusually high CPU, memory, or background network usage, especially from a process you don't recognize.
• Browser or system slowdowns that start suddenly, with no update or new program to explain them.
• Unfamiliar programs or browser extensions you don't remember installing.
• Accounts showing suspicious logins, password reset emails you didn't request, or activity you can't explain.

As both Kaspersky and CrowdStrike emphasize, many infections produce none of these signs, which is why a security-software scan, not just watching for glitches, is the reliable way to check.

Warning signs of a keylogger on a phone

Mobile keyloggers are almost always software, since there is no realistic equivalent of a hardware adapter for a modern smartphone's built-in keyboard. Malwarebytes notes that stalkerware-style keyloggers on Android and iPhone are typically installed either through a phishing link or by someone with brief physical access to an unlocked phone, since both platforms otherwise restrict background keystroke access without special permissions. Signs to watch for include:

• Faster-than-normal battery drain or a phone that stays warm even when idle.
• Spikes in mobile data use that don't match your own usage.
• Unfamiliar apps, or a keyboard app you did not choose, set as the default input method.
• New device-administrator or accessibility permissions granted to an app you don't recognize, which some spyware abuses to read on-screen text.

A compromised device undermines even strong app-level encryption, because a keylogger captures text at the point where you type it, before any encryption is applied. That is one more reason the device itself, not just the apps on it, needs to stay clean.

How attackers actually use keyloggers

CrowdStrike's research describes keyloggers as rarely an end in themselves; they are a data-collection step that feeds a bigger attack. Captured usernames and passwords get reused to log into email, banking, or corporate accounts. Captured personal details help an attacker craft a more convincing follow-up phishing or social-engineering attempt. In corporate intrusions, a keylogger planted after an initial breach, sometimes following exploitation of an unpatched remote-access product (our coverage of a critical SonicWall SMA1000 VPN flaw is one example of the kind of foothold attackers look for), can sit quietly harvesting administrator credentials for weeks before anything else happens. That stolen access is frequently the starting point for the account takeovers behind business email compromise fraud and larger ransomware intrusions alike.

How to detect and remove a keylogger

There is no single guaranteed way to confirm a keylogger is present, but the following steps, drawn from vendor and government guidance, cover most real-world cases.

• Run a full scan with reputable security software. Malwarebytes recommends a scanner that combines signature detection with heuristic and behavior-based analysis, since well-hidden keyloggers can disguise themselves as normal files or system processes.
• Check installed programs, browser extensions, and running processes for anything unfamiliar, and remove what you don't recognize and didn't install.
• Update everything, then rescan. Security patches can remove the vulnerability a keylogger rode in on and sometimes disrupt how the malware maintains itself.
• Inspect cables and ports for hardware versions. Since security software generally cannot see a hardware keylogger, a visual check of USB ports, keyboard cables, and any unfamiliar inline adapters is the only reliable way to catch one, as Kaspersky's guidance notes.
• When in doubt, wipe and restore from a known-clean backup, or, for a severely compromised device, a factory reset followed by reinstalling only trusted software.
• Change your passwords, from a different, clean device, once you believe the keylogger is removed, since any password typed while it was active should be treated as exposed.

What to do next: preventing keylogger infections

Prevention is far cheaper than cleanup. The following practices, based on CISA's cyber-hygiene recommendations and vendor guidance, meaningfully reduce the risk of a keylogger infection and limit the damage if one still gets through:

• Turn on multi-factor authentication everywhere it's offered. CISA and the FTC both highlight MFA as one of the single most effective protections, because a stolen password alone is no longer enough to log in.
• Keep your operating system, browser, and apps updated so known vulnerabilities used to deliver spyware get patched automatically.
• Run real-time anti-malware protection on computers and phones, and schedule regular full scans rather than relying only on real-time alerts.
• Slow down on links and attachments. Per FTC guidance, treat unexpected billing, delivery, or account-alert messages with suspicion, and go to a company's site directly rather than clicking through.
• Avoid unfamiliar USB drives and public computers for anything sensitive, and never leave a personal device unlocked and unattended.
• Use a password manager so that even if one credential is captured, it isn't reused across your other accounts.

None of these steps make a device immune, but together they close most of the paths a keylogger relies on, and they make a successful infection far less costly to recover from.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage