How keylogger works
Software keyloggers run quietly on an endpoint, hooking keyboard input or capturing screen content, and periodically send the data to the attacker. They are usually delivered through phishing, malicious downloads or other malware, and may be combined with remote access tools.
Hardware keyloggers are small devices placed between a keyboard and a computer or built into compromised peripherals. They require physical access, so they are less common, but matter in shared or poorly supervised workspaces. Some keyloggers also capture clipboard contents, screenshots and web form data, which lets them steal credentials even from password managers that auto-fill or copy values.
Why it matters for Canadian organizations
Credentials captured by a keylogger can unlock email, banking, cloud and administrative accounts, often without any visible sign of compromise. A single infected laptop can lead to broader intrusion and exposure of personal information.
Organizations subject to PIPEDA, Quebec Law 25 or OSFI B-13 are expected to protect credentials and detect compromise. Multi-factor authentication significantly reduces the value of captured passwords, though session theft and real-time phishing can still succeed. Mobile devices can be affected through malicious apps or overlay attacks, so the same principles of limiting installations and keeping devices updated apply there.
How to defend against it
Deploy endpoint protection with behavioural detection, keep systems patched and restrict software installation. Use multi-factor authentication, ideally phishing-resistant methods, on important accounts.
Use password managers, which avoid typing credentials, inspect physical ports and peripherals in sensitive areas, and train staff to spot phishing. Monitor for new startup items, unusual outbound connections and unexpected input hooks. If a keylogger is found, treat every credential typed on the affected device as compromised, rebuild the system from a trusted image and review account activity for misuse.
Frequently asked questions
How do I know if I have a keylogger?
Signs can include slowdowns, unfamiliar processes or startup items, unexpected network activity and accounts being accessed unexpectedly. Many keyloggers are hidden, so rely on endpoint detection scans and, if compromise is suspected, treat passwords as exposed and reset them from a clean device.
Does multi-factor authentication stop keyloggers?
It greatly limits the damage, because a stolen password alone is not enough. However, attackers may capture one-time codes in real time or steal session tokens, so phishing-resistant methods such as hardware security keys offer stronger protection.
Are keyloggers illegal?
Using a keylogger to secretly capture someone else's data without authorization is illegal in Canada and most jurisdictions. Some organizations deploy monitoring tools lawfully with disclosure and consent, but covert use against others can breach criminal and privacy law.
Related service: Endpoint detection and response