Technique:  Input Capture:Keylogging
During the 2015 Ukraine Electric Power Attack, It gathered account credentials via a BlackEnergy keylogger plugin.
ADVSTORESHELL can perform keylogging.
Agent Tesla can log keystrokes on the victim’s machine.
It has used CWoolger and MPK, custom-developed malware, which recorded all keystrokes on an infected system.
AppleSeed can use GetKeyState and GetKeyboardState to capture keystrokes on the victim’s machine.
It has used tools to perform keylogging.
It has used a keylogging tool that records keystrokes in encrypted files.
It has abused the PasswordChangeNotify to monitor for and capture account password changes.
It used a Trojan called KEYLIME to capture keystrokes from the victim’s machine.
It has used tools for capturing keystrokes.
It used a keylogger called GEARSHIFT on a target system.
Astaroth logs keystrokes from the victim's machine.
AsyncRAT can capture keystrokes on the victim’s machine.
One of Attor's plugins can collect user credentials via capturing keystrokes and can capture keystrokes pressed within the window of the injected process.
BabyShark has a PowerShell-based remote administration ability that can implement a PowerShell or C# based keylogger.
When it first starts, BADNEWS spawns a new thread to log keystrokes.
BadPatch has a keylogging capability.
Bandook contains keylogging capabilities.
BISCUIT can capture keystrokes.
BlackEnergy has run a keylogger plug-in on a victim.
Cadelspy has the ability to log keystrokes on the compromised host.
It logs key strokes for configured processes and sends them back to the C2 server.
Cardinal RAT can log keystrokes.
Catchamas collects keystrokes from the victim’s machine.
CHOPSTICK is capable of performing keylogging.
Clambling can capture keystrokes on a compromised host.
Cobalt Strike can track key presses with a keylogger module.
Cobian RAT has a feature to perform keylogging on the victim’s machine.
CosmicDuke uses a keylogger.
Crimson can use a module to perform keylogging on compromised hosts.
Cuba logs keystrokes via polling by using GetKeyState and VkKeyScan functions.
DarkComet has a keylogging capability.
It has used a keylogger.
DarkTortilla can download a keylogging module.
DarkWatchman can track key presses with a keylogger module.
Daserf can log keystrokes.
Derusbi is capable of logging keystrokes.
DOGCALL is capable of logging keystrokes.
Dtrack’s dropper contains a keylogging executable.
Duqu can track key presses with a keylogger module.
DustySky contains a keylogger.
ECCENTRICBANDWAGON can capture and store keystrokes.
Empire includes keylogging capabilities for Windows, Linux, and macOS systems.
EvilGrab has the capability to capture keystrokes.
Explosive has leveraged its keylogging capabilities to gain access to administrator accounts on target servers.
FakeM contains a keylogger module.
It has logged the keystrokes of victims to escalate privileges.
It has captured credentials via fake Outlook Web App (OWA) login pages and has also used a .NET based keylogger.
FlawedAmmyy can collect keyboard events.
The FunnyDream Keyrecord component can capture keystrokes.
Fysbis can perform keylogging.
gh0st RAT has a keylogger.
Grandoreiro can log keystrokes on the victim's machine.
GreyEnergy has a module to harvest pressed keystrokes.
Malware used by It is capable of capturing keystrokes.
The executable version of Helminth has a module to log keystrokes.
It has used a PowerShell-based keylogger named kl.ps1.
HTTPBrowser is capable of capturing keystrokes on victims.
Imminent Monitor has a keylogging module.
InvisiMole can capture keystrokes on a compromised host.
JPIN contains a custom keylogger.
jRAT has the capability to log keystrokes from the victim’s machine, both offline and online.
Kasidet has the ability to initiate keylogging.
It has used keyloggers.
KeyBoy installs a keylogger for intercepting credentials and keystrokes.
KGH_SPY can perform keylogging by polling the GetAsyncKeyState() function.
It has used a PowerShell-based keylogger as well as a tool called MECHANICAL to log keystrokes.
Kivars has the ability to initiate keylogging on the infected host.
KONNI has the capability to perform keylogging.
It malware KiloAlfa contains keylogging functionality.
Lokibot has the ability to capture input on the compromised host via keylogging.
It logs keystrokes from the victim’s machine.
MacMa can use Core Graphics Event Taps to intercept user keystrokes from any text input field and saves them to text files. Text input fields include Spotlight, Finder, Safari, Mail, Messages, and other apps that have text fields for passwords.
MacSpy captures keystrokes.
It malware is capable of keylogging.
MarkiRAT can capture all keystrokes on a compromised host.
Matryoshka is capable of keylogging.
It has used key loggers to steal usernames and passwords.
metaMain has the ability to log keyboard events.
Metamorfo has a command to launch a keylogger and capture keystrokes on the victim’s machine.
Micropsia has keylogging capabilities.
MoonWind has a keylogger.
NanoCore can perform keylogging on the victim’s machine.
NavRAT logs the keystrokes on the targeted system.
NetTraveler contains a keylogger.
NETWIRE can perform keylogging.
NightClub can use a plugin for keylogging.
njRAT is capable of logging keystrokes.
It has used keylogging tools called KEYPUNCH and LONGWATCH.
Okrum was seen using a keylogger tool to capture keystrokes.
During Operation Wocao, threat actors obtained the password for the victim's password manager via a custom keylogger.
OwaAuth captures and DES-encrypts credentials before writing the username and password to a log file, C:\log.txt.
PcShare has the ability to capture keystrokes.
Peppy can log keystrokes on compromised hosts.
It has used several different keyloggers.
PlugX has a module for capturing keystrokes per process including window titles.
PoetRAT has used a Python tool named klog.exe for keylogging.
PoisonIvy contains a keylogger.
PoshC2 has modules for keystroke logging and capturing credentials from spoofed Outlook authentication messages.
PowerLess can use a module to log keystrokes.
PowerSploit's Get-Keystrokes Exfiltration module can log keystrokes.
Prikormka contains a keylogger module that collects keystrokes and the titles of foreground windows.
Proton uses a keylogger to capture keystrokes.
Pupy uses a keylogger to capture keystrokes it then sends back to the server after it is stopped.
QakBot can capture keystrokes on a compromised host.
QuasarRAT has a built-in keylogger.
RCSession has the ability to capture keystrokes on a compromised host.
Regin contains a keylogger.
Remcos has a command for keylogging.
Remexi gathers and exfiltrates keystrokes from the machine.
Remsec contains a keylogger component.
Revenge RAT has a plugin for keylogging.
ROKRAT can use  SetWindowsHookEx and GetKeyNameText to capture keystrokes.
Rover has keylogging functionality.
It can record keystrokes from both the keyboard and virtual keyboard.
RunningRAT captures keystrokes and sends them back to the C2 server.
It has used a keylogger to capture keystrokes by using the SetWindowsHookEx function.
SILENTTRINITY has a keylogging capability.
SLOTHFULMEDIA has a keylogging capability.
SMOKEDHAM can continuously capture keystrokes.
It has used keylogging tools.
SslMM creates a new thread implementing a keylogging facility using Windows Keyboard Accelerators.
Sykipot contains keylogging functionality to steal passwords.
TajMahal has the ability to capture keystrokes on an infected host.
ThiefQuest uses the CGEventTap functions to perform keylogging.
It actors installed a credential logger on Microsoft Exchange servers. It also leveraged the reconnaissance framework, ScanBox, to capture keystrokes.
TinyZBot contains keylogger functionality.
It has used keylogging tools in their operations.
Trojan.Karagany can capture keystrokes on a compromised host.
Unknown Logger is capable of recording keystrokes.
VERMIN collects keystrokes from the victim machine.
WarzoneRAT has the capability to install a live and offline keylogger, including through the use of the GetAsyncKeyState Windows API.
XAgentOSX contains keylogging functionality that will monitor for active application windows and write them to the log, it can handle special characters, and it will buffer by default 50 characters before sending them out over the C2 infrastructure.
yty uses a keylogger plugin to gather keystrokes.
Zeus Panda can perform keylogging on the victim’s machine by hooking the functions TranslateMessage and WM_KEYDOWN.
ZxShell has a feature to capture a remote computer's keystrokes using a keylogger.