Someone Is Reading Everything You Type: How to Find and Remove a Keylogger

Watch the 2-minute video:

Picture this. You write your best idea at two in the morning. You save it and tell no one. A week later someone else launches it, with the same name and the same words.

Nobody hacked your cloud. Someone was inside your keyboard.

What a keylogger is

A keylogger is a program (or a small device) that records every key you press: passwords, messages, card numbers, and every idea you type. Modern ones also grab saved browser passwords, cookies and screenshots. They send it all to the attacker every few minutes, usually by email (SMTP), FTP, or a Telegram bot.

How one got in this year: VIP Keylogger

In March 2026, K7 Security Labs analysed a VIP Keylogger campaign (a “malware as a service” keylogger anyone can rent):

• The email looked like a normal purchase order.
• The attachment was a RAR file holding something that looked like a spreadsheet, named like ..._xlsx.exe. It wasn’t Excel. It was a program.
• One double-click loaded the keylogger straight into memory.
• It stole logins, cookies, autofill and card data from 40+ browsers, plus Outlook, Thunderbird, Discord and FileZilla, and sent it out over SMTP on port 587, FTP, Telegram or Discord.

It’s not just big companies. In June 2026, The Hacker News reported an attacker who planted a keylogger at a small car business, stole banking and email passwords, then installed OpenSSH and Tailscale to keep a back door.

Find it

1. Check your startup apps

Most keyloggers start with Windows.

1. Press Ctrl + Shift + Esc and open Startup apps.
2. Look for an app with no publisher, or a name you don’t know (fake names like svchost32 are common).
3. Right-click it, choose Open file location and note the path, then Disable it.

Task Manager doesn’t show everything. For hidden entries (scheduled tasks, services, registry Run keys) use Autoruns from Microsoft Sysinternals. In Options, tick Hide Microsoft Entries and Verify Code Signatures. Pink rows marked (Not Verified) that run from AppData or Temp deserve a closer look.

2. Catch it talking

A keylogger is useless to the attacker unless it sends the data out. Open PowerShell as Administrator and list your live connections with the app behind each one:

Get-NetTCPConnection -State Established |
  Select-Object RemoteAddress, RemotePort,
    @{n='App';e={(Get-Process -Id $_.OwningProcess).Name}},
    @{n='Path';e={(Get-Process -Id $_.OwningProcess).Path}} |
  Sort-Object App | Format-Table -AutoSize

Red flags:

Just the mail and FTP ports:

Get-NetTCPConnection | Where-Object RemotePort -in 21,25,465,587 |
  Select-Object RemoteAddress, RemotePort, State,
    @{n='App';e={(Get-Process -Id $_.OwningProcess).Path}}

3. Look behind the PC

Not every keylogger is software. A hardware keylogger is a small plug that sits between the keyboard cable and the USB port, and no antivirus can see it. Follow your keyboard cable. If there’s an adapter you didn’t put there, pull it out. In an office, tell IT or security first, because it’s evidence.

Fix it

4. Run a Microsoft Defender Offline scan

Some malware hides while Windows is running. The offline scan restarts the PC into a clean environment and scans from there (about 15 minutes, so save your work).

• Windows Security > Virus & threat protection > Scan options > Microsoft Defender Offline scan > Scan now
• or, in admin PowerShell: Start-MpWDOScan

Check the result in Protection history. If BitLocker asks for a recovery key, suspend BitLocker before you start.

5. Change your passwords from another device

Assume everything you typed is already stolen. Use your phone or another clean device, not that PC:

1. Change your email password first. Email is the key to resetting everything else.
2. Sign out of all sessions in each account, so the attacker’s logins stop working.
3. Turn on passkeys or MFA (an authenticator app is better than SMS). A stolen password alone then won’t open the door.
4. Then change banking, work, social and any password you reused.

6. Make sure a fake invoice can’t fool you again

Windows hides file extensions by default, so Invoice_xlsx.exe can show up as Invoice_xlsx with an Excel icon. Turn them on:

File Explorer > View > Show > File name extensions

or in PowerShell:

Set-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced' -Name HideFileExt -Value 0

If the keylogger keeps coming back after the offline scan, back up your files and reset Windows (Settings > System > Recovery).

Checklist

• [ ] Startup apps: nothing without a publisher you don’t know
• [ ] Autoruns: no “(Not Verified)” entries from AppData or Temp
• [ ] Connections: no unknown app on ports 587/465/25/21 or talking to Telegram
• [ ] No strange plug between the keyboard and the PC
• [ ] Microsoft Defender Offline scan done
• [ ] Email password changed from your phone, all sessions signed out
• [ ] Passkeys or MFA on for email, bank and work
• [ ] File name extensions turned on

The man in black just lost his connection. Your ideas are yours again.

Watch the video:

Abd Almouhimen Shamout, Take away support: IT fixes delivered in under two minutes. mouhimen.dev

Sources

• GBHackers, “MaaS VIP Keylogger Campaign Uses Steganography to Steal Credentials at Scale” (March 9, 2026): https://gbhackers.com/maas-vip-keylogger-campaign/
• Seqrite, “Spear Phishing Campaign Delivers VIP Keylogger via Email Attachment”: https://www.seqrite.com/blog/spear-phishing-campaign-delivers-vip-keylogger-via-email-attachment/
• Splunk, “Behind the Code: The Layered Defense-Evasion of VIP Keylogger”: https://www.splunk.com/en_us/blog/security/behind-the-code-layered-defense-evasion-vip-keylogger.html
• The Hacker News, keylogger news (June 17, 2026, keylogger at a small automotive business): https://thehackernews.com/search/label/keylogger
• Microsoft Learn, Microsoft Defender Offline scan: https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-offline
• Microsoft Learn, Autoruns (Sysinternals): https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
• Microsoft Learn, Get-NetTCPConnection: https://learn.microsoft.com/en-us/powershell/module/nettcpip/get-nettcpconnection