Key Base Keylogger Malware Family Exposed
Summary: Unit 42 tracked a keylogger family called KeyBase, sold for $50 directly by its author and in the wild since February 2015, with Palo Alto Networks' AutoFocus identifying 295 unique samples across roughly 1,500 sessions in four months, mainly delivered through phishing emails against high tech, higher education, and retail. The C# .NET malware hooks the keyboard via SetWindowsHookExA, persists through the startup folder as 'Important.exe' or a Run registry key, and sends clipboard, keystroke, and screenshot data to about 50 identified C2 servers over unencrypted HTTP.
What's compelling: A $50 tool with no encryption on its C2 traffic and no authentication on its image-upload path still generated roughly 1,500 sessions in four months, and one operator's own screenshots exposed his desktop, his spam server, and his Facebook account in Mbieri, Nigeria.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026