{
  "family": "keybase",
  "sample_count": 2,
  "category": "advanced_threat",
  "description": "Spyware:Win32/Keybase is a prolific, commercially available software tool weaponized as a keylogger and spyware agent. Originally sold legally as an 'employee monitoring' tool, its builder software was cracked and leaked onto underground hacker forums. Consequently, Keybase became heavily utilized by low-skill cybercriminals ('script kiddies') to mount widespread, untargeted credential theft campaigns via phishing, completely eliminating privacy on infected machines.<br><br><b>Understanding Keybase (Commercial Keyloggers)</b><br>To an end-user, Keybase operates invisibly in the background. For a SOC analyst, detecting Keybase indicates an immediate breach of confidentiality; the attacker has successfully installed software that records every keystroke, clipboard copy, and website visited (`T1056.001`). Unlike advanced APT malware, Keybase is 'noisy' and easier to detect, but highly destructive if left unchecked.<br><br><b>Execution and Espionage Mechanics</b><br>Keybase is typically distributed via spam emails containing weaponized attachments (e.g., fake invoices or tracking receipts) (`T1566.001`). Upon execution (`T1204.002`), the compiled stub drops the main keylogger executable into the `%AppData%` directory and establishes persistence via the `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run` registry key. It hooks into the Windows API (like `SetWindowsHookEx`) to intercept all keyboard input. It captures clipboard contents (`T1115`) and periodically takes screenshots of the active window (`T1113`). The harvested data is compiled into HTML or text files and exfiltrated to the attacker via SMTP (emailing the logs), FTP, or a web panel (`T1041`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the total theft of all passwords, personal communications, and financial data entered on the machine. Host-based IoCs include EDR alerts for 'Suspicious API Hooking' (specifically keyboard hooks). A strong indicator is the creation of hidden directories in `%AppData%` containing massive text files (the key logs) and hundreds of screenshots. Network IoCs include the malware attempting to establish outbound SMTP (Port 25/587) or FTP (Port 21) connections to upload the stolen logs.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1113",
    "T1041",
    "T1056.001",
    "T1115"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging (Primary data theft mechanism)",
      "tactic": "Collection"
    },
    {
      "id": "T1115",
      "name": "Clipboard Data (Stealing copied passwords and crypto addresses)",
      "tactic": "Collection"
    },
    {
      "id": "T1113",
      "name": "Screen Capture (Visual confirmation of activity)",
      "tactic": "Collection"
    },
    {
      "id": "T1041",
      "name": "Exfiltration Over C2 Channel (Uploading logs via SMTP/FTP)",
      "tactic": "Exfiltration"
    }
  ],
  "containment_steps": [
    "Immediately isolate the compromised endpoint; all typed passwords and viewed documents are actively being exfiltrated.",
    "Mandate an immediate password reset for the affected user, covering ALL corporate and personal accounts accessed on that machine.",
    "Uninstall the software and run a full AV scan to remove the executable and its autostart registry keys.",
    "Analyze firewall logs to determine the exfiltration destination (e.g., the attacker's email server or FTP site) and block it."
  ],
  "what_to_avoid": [
    "Do not allow the user to type new passwords on the machine until Keybase is fully removed, as the new passwords will simply be logged.",
    "Avoid treating this solely as a corporate issue; advise the user to monitor personal bank accounts, as the attacker likely stole those credentials as well."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}