Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Key Base Threat Grows Despite Public Takedown: A Picture is Worth a Thousand Words

Summary: Unit 42 reported that KeyBase, a keylogger first seen in February 2015, remained downloadable from multiple websites and grew from roughly 1,500 sessions to over 4,900 samples and 44,200 sessions in AutoFocus about six months after its June 2015 report, despite the author's takedown of its site. Researchers identified 64 websites hosting 82 active KeyBase web panels with 933 infected Windows systems and 125,083 screenshots, because the panel's screenshot directory required no authentication.

What's compelling: The exposed panels showed 33 infected systems using online banking, including corporate accounts and a transfer receipt for USD $51,500, plus one logistics company's account with a balance over USD $500,000 - and the malware logs the credentials to those same sites.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026