A keylogger is software or a small hardware device that secretly records every keystroke typed on a computer or phone — passwords, banking logins, messages, documents — and sends the log to whoever planted it. It captures credentials at the exact moment they are typed, which is why a keylogger steals a password before encryption, password managers or multi-factor authentication ever get a say.
TL;DR
- A keylogger records every keystroke on a device and sends the log to an attacker.
- It arrives through phishing attachments, fake software downloads, malicious browser extensions and infected USB devices.
- A password typed while a keylogger runs is compromised even if multi-factor authentication is switched on.
- Anti-malware catches known keyloggers; staff awareness stops the install, which is the only reliable fix.
- Cyber Aware's phishing simulations and monthly training target the delivery routes keyloggers depend on.
What is a keylogger?
A keylogger — short for keystroke logger — is surveillance software or hardware built to do one thing: record the keys a person presses. Most keyloggers run silently in the background, store the captured text locally or stream it to a remote server, and disguise themselves as legitimate processes so the user never notices.
Security teams sort them into a few types. Software keyloggers hook the keyboard interface, sit at the operating system's kernel level, or grab text from web forms as it is submitted. Many modern information stealers add screenshot capture, clipboard monitoring and saved-browser-password theft on top of keystrokes, so the log ends up holding far more than typed text. Hardware keyloggers are rarer but harder to find: a small inline device between keyboard and computer, a USB dongle, or a wireless sniffer that reads keyboard radio traffic. In small businesses the software kind dominates, because it spreads by email and download at almost no cost to the attacker.
How a keylogger gets onto a device
A keylogger needs one thing to succeed: a person who installs it. The delivery routes are unglamorous and repeat year after year:
- A phishing email with an invoice, résumé or voicemail attachment that carries the loader.
- A fake download — a free PDF converter, a cracked app, a browser update — that installs the logger alongside whatever the user actually wanted.
- A malicious browser extension that records everything typed into web pages.
- A USB device plugged into an office machine, dropped on purpose or already infected.
- A compromised website that serves a payload to visitors running outdated software.
Notice what these routes have in common: most of them start with a person making a decision inside their inbox or browser. That is why keyloggers keep working in 2026 even at companies with firewalls and endpoint tools — the malware does not break in, it gets invited.
What a keylogger costs a business
The direct cost is stolen credentials. A captured banking login leads to payment fraud. A captured email password leads to mailbox takeover, and from there to fake invoices sent to customers and suppliers who trust the sender. The scale of the surrounding threat in Australia is measured, not hypothetical: the Australian Signals Directorate received more than 84,700 cybercrime reports in 2024-25 — an average of one every six minutes — and the average self-reported cost of cybercrime for a small business rose 14 per cent to $56,600 per report (ASD Annual Cyber Threat Report 2024-25).
The indirect cost is quieter. Once credentials leak, attackers may sit inside an account for weeks before anyone notices, and every downstream account that reuses the same password inherits the breach. Recovering from one keylogger incident routinely costs more than a full year of structured security awareness training for the entire team.
Signs a device has a keylogger
Keyloggers are built to be invisible, but clumsy builds leave traces:
- Sudden sluggishness when typing, or a lag between keypress and text appearing.
- Unknown processes in Task Manager or Activity Monitor, or browser extensions nobody installed.
- Outbound network activity right after signing in to sensitive sites.
- Colleagues or customers replying to messages that were never sent.
- Email or password-manager warnings about sign-ins from unfamiliar locations.
None of these alone proves a keylogger, and a well-built one shows none of them at all. Treat the symptoms as a prompt to scan the device and rotate credentials from a known-clean machine — not as a diagnosis.
How to stop keyloggers
- Multi-factor authentication everywhere. A keylogger that captures a password hits a wall when the second factor is an app prompt or hardware key. This is the highest-value control on the list.
- Endpoint protection with behaviour detection. Anti-malware catches known keyloggers; modern endpoint tools also flag keystroke-hooking behaviour before a signature exists.
- Patch operating systems, browsers and plugins. Drive-by installs depend on old software.
- Least privilege. A workstation that blocks unauthorised installs stops a keylogger from persisting even when someone clicks.
- Restrict USB storage on machines where the risk justifies it.
- Train the instinct not to install. This last control decides whether every other control gets tested at all.
Why awareness training is the control that scales
Technical controls shrink the blast radius, but the delivery routes renew themselves constantly: new lures, new fake download sites, new attachment formats. What has to hold is the decision a person makes in the ten seconds before an install. That decision is trainable.
Structured programs make it stick. Cyber Aware runs security awareness training on a monthly cadence, and anyone who clicks a simulated phishing email is auto-enrolled into remediation training the same day — so the people most exposed to keylogger delivery get more practice, not more blame. Over months, click rates fall and reports of suspicious email rise: exactly the two behaviours that block keylogger installs in 2026.
Making the training count as compliance evidence
Australian frameworks increasingly expect this discipline. Essential 8 and SMB1001 both reward organisations that can show users are trained and phishing is tested regularly, and cyber insurers ask for the same evidence at renewal. A cyber security gap assessment shows which of these controls you can already evidence and which gaps to close next, before an auditor or an attacker asks the question.
FAQ
What is a keylogger in simple terms? A program or device that secretly records everything you type and sends it to an attacker. In 2026 most are software delivered through phishing or fake downloads, and passwords, banking details and messages typed while one runs are all captured.
Can a keylogger steal my password if I use multi-factor authentication? It captures the password, but MFA usually blocks the login attempt. Attackers then pivot to repeated approval prompts or session theft, so MFA slows them down rather than stopping them outright.
Does antivirus detect keyloggers? Known keyloggers, usually yes. Kernel-level or freshly built ones can evade signature detection, which is why behaviour-based endpoint protection and user awareness both matter.
Are hardware keyloggers a real risk for small businesses? Rare, but real in targeted cases — shared reception computers, point-of-sale terminals or any machine a visitor can touch for a minute. A physical inspection of keyboard ports and USB slots finds them.
How do I remove a keylogger? Disconnect the device from the network, scan it with updated endpoint tools, remove unknown browser extensions, then rotate every password typed on that device — from a different, clean machine.
Can a password manager protect against keyloggers? Partly. Auto-filled passwords never pass through the keyboard, so the keylogger captures nothing from those logins. Manually typed master passwords and MFA codes are still exposed, which is why auto-fill plus MFA is the stronger combination.
One last thing
The cheapest anti-keylogger habit costs nothing: for logins that matter, type part of the password somewhere else first — the search box works — and paste the rest. Keyloggers capture what is typed, not what is pasted. It is a workaround, not a strategy, but it shows the principle that holds in 2026: every step that raises the attacker's cost per stolen password makes your business a worse target.
Related guides
- Human risk reporting — see who reports suspicious email and who clicks.
- Compare Cyber Aware with other platforms — how the delivery model stacks up.