cve.bz

CAPEC-568

Capture Credentials via Keylogger

High severityDetailed pattern

An adversary deploys a keylogger in an effort to obtain credentials directly from a system's user. After capturing all the keystrokes made by a user, the adversary can analyze the data and determine which string are likely to be passwords or other credential related information.

On this page

Ask an AI about this attack pattern

ChatGPTClaudeGoogle AI Mode

Show the promptExplain the attack pattern CAPEC-568: Capture Credentials via Keylogger: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/568.html and https://cve.bz/cve/capec/568?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.

How the attack unfolds

  1. Explore

    The attacker looks for a way in.

    1. [Determine which user's credentials to capture] Since this is a more targeted attack, an adversary will first identify a particular user they wish the capture the credentials of.

  2. Experiment

    They probe what they found.

    1. [Deploy keylogger] Once a user is identified, an adversary will deploy a keylogger to the user's system in one of many ways.

      4 techniques
      • Send a phishing email with a malicious attachment that installs a keylogger on a user's system
      • Conceal a keylogger behind fake software and get the user to download the software
      • Get a user to click on a malicious URL that directs them to a webpage that will install a keylogger without their knowledge
      • Gain access to the user's system through a vulnerability and manually install a keylogger

    2. [Record keystrokes] Once the keylogger is deployed on the user's system, the adversary will record keystrokes over a period of time.

    3. [Analyze data and determine credentials] Using the captured keystrokes, the adversary will be able to determine the credentials of the user.

      3 techniques
      • Search for repeated sequences that are following by the enter key
      • Search for repeated sequences that are not found in a dictionary
      • Search for several backspaces in a row. This could indicate a mistyped password. The correct password can then be inferred using the whole key sequence

  3. Exploit

    They carry out the attack.

    1. [Use found credentials] After the adversary has found the credentials for the target user, they will then use them to gain access to a system in order to perform some follow-up attack

Prerequisites

  • The ability to install the keylogger, either in person or remote.

Mitigations

  • Strong physical security can help reduce the ability of an adversary to install a keylogger.

Part of
Can lead to

MITRE's words, unchanged: CAPEC-568 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.