Keylogger: what it is, how to detect it and how to protect yourself

You type your banking password, your work email, your credit card number. On the other side, an invisible program is recording every keystroke and sending it all to a server controlled by someone else. That's a keylogger — and it doesn't open a pop-up, doesn't leave a visible trace, doesn't ask for permission.

What is a keylogger?

A keylogger is any tool — software or hardware — capable of capturing and recording the keys typed on a keyboard. The goal is almost always the same: obtaining access credentials, banking details or sensitive information without the victim noticing.

There are two main types:

• Software keylogger: a program that runs in the background on the operating system. It intercepts keystrokes before the system processes them and sends the log — usually encrypted — to a remote server at regular intervals. It's the most common type because it can be distributed via malicious email, an infected download or bundled with other malware.
• Hardware keylogger: a physical device installed between the keyboard and the computer's USB (or PS/2) port. It looks like a simple adapter, but records everything internally. Less common for home users, but it does happen in corporate environments, internet cafes and shared terminals. Detecting it requires physically inspecting the equipment.

How does a keylogger get onto your computer?

The infection vectors are the same as for any malware:

• Phishing: an email with an attachment or link that installs the keylogger disguised as a PDF document, an invoice or a system update.
• Pirated software: installers for cracked programs frequently bundle keyloggers or other infostealers alongside the main executable.
• Drive-by download: compromised sites that exploit vulnerabilities in the browser or in outdated plugins to install the malware with no user interaction.
• Bundled with other malware: trojans and ransomware frequently carry a keylogging component to maximize the theft before encrypting the files.

How do you know if there's a keylogger on your PC?

What are the signs of a keylogger on a computer?

In most cases, a well-made keylogger produces no visible symptoms. That's precisely the point — any obvious sign gives it away. That said, poorly optimized versions can cause:

• A delay between what you type and what appears on screen (input lag).
• CPU spikes or memory usage with no identifiable process in Task Manager.
• Unusual outbound network traffic, especially during periods of inactivity.
• Accounts compromised even without password reuse — a sign the password was captured as it was typed, not leaked by a third party.

If any of those patterns show up, investigating is necessary — you can't wait for the problem to solve itself.

How to detect a keylogger (step by step)

1. Check for suspicious processes and startup entries

Open Task Manager (Ctrl + Shift + Esc), go to Processes and sort by CPU/memory usage. Processes with generic names (svchost32.exe, update.exe) or with no publisher description deserve attention. In the Startup tab, disable any unknown entries that are enabled.

2. Run an antimalware scan

Tools like Malwarebytes (a free version is available) have a good detection rate for keyloggers and infostealers. Run the scan in safe mode (restart pressing F8, or Shift + Restart → Troubleshoot → Advanced startup → Safe Mode) — in that mode the keylogger doesn't load with Windows, which makes removal easier.

3. Check the USB ports

If you use a shared computer — in an office, a hotel, an internet cafe — physically inspect the connection between the keyboard and the PC. A hardware keylogger looks like a small extra USB adapter. If there's any intermediate device you didn't install, don't use that machine for sensitive data.

How to remove a keylogger

If your antivirus identifies the threat, follow the tool's removal instructions. If the malware reappears after removal (a sign that it reinstalls itself automatically through another entry point), the safest option is to reinstall the operating system and restore files from a clean backup — preferably a backup made before the infection.

Before reinstalling, change every password that may have been captured — use a different, uncompromised device for that. Any password typed on the infected machine should be considered compromised.

How to protect yourself from keyloggers

1. Use a password manager

A password manager like Bitwarden fills in credentials via autofill — without you having to type the password manually. A software keylogger doesn't capture what the system fills in automatically through the autofill API; it captures what passes through the keyboard hook, which autofill bypasses.

2. Turn on two-factor authentication

Even if a keylogger captures your password, the second authentication factor (TOTP) adds a barrier the attacker has to beat in real time — the code expires in 30 seconds. It doesn't eliminate the risk entirely, but it raises the cost of the attack significantly.

3. Avoid software from unknown sources

Most software keyloggers arrive via an executable the user installs themselves. Downloading only from official sources — the manufacturer's site, the Microsoft Store, the operating system's own store — eliminates the main infection vector.

4. Keep your antivirus active and up to date

Windows Defender, built into Windows 10/11, has good coverage for known keyloggers as long as it's updated. For an extra layer, periodic scans with Malwarebytes complement it well.

5. Don't use other people's computers for critical data

Banking, work email, cryptocurrency wallets — never access those on machines you don't control. If it's unavoidable, prefer the bank's on-screen keyboard (when available) to the machine's physical keyboard.

What happens to the captured data?

A keylogger's logs — bundles containing passwords, card details, typing history — are sold on dark web marketplaces. Prices vary: a generic home-user log can cost less than a dollar; logs with active banking access, corporate accounts or cryptocurrency wallets reach hundreds of dollars each.

Those logs feed directly into credential stuffing attacks — where stolen credentials are tested at scale against other services. Kaspersky reported that more than a million bank accounts were compromised in 2025 as a result of infostealer malware, a category that includes advanced keyloggers.

Conclusion

A keylogger doesn't require you to click something obvious or ignore a screaming alert. It lives off invisibility. The most effective defense isn't detecting the malware after it's installed — it's reducing what you type manually (a password manager), adding layers the captured log doesn't defeat (2FA), and not giving the malware a chance to get in at all (trusted sources, an active antivirus).

For a wider view of digital security habits, it's worth reading the definitive guide to privacy and OPSEC — it covers everything from system settings to behaviors that reduce your overall exposure.