{
  "family": "realspy",
  "sample_count": 1,
  "category": "advanced_threat",
  "description": "<h3>Executive Summary</h3>\nRealSpy is a commercially available software application marketed for employee monitoring and parental control. However, due to its deep system hooking capabilities, covert operation mode, and the ability to log highly sensitive data (keystrokes, screenshots, clipboard contents), it is broadly classified by the security industry as \"Riskware\" or a Potentially Unwanted Program (PUP) operating as a commercial keylogger.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nBecause RealSpy is commercial software, it is downloaded from the vendor's website. However, in an enterprise context, it becomes a severe security threat when installed covertly by an unauthorized party (e.g., an insider threat, a jealous partner, or a threat actor who has gained local access to the machine).\n\nWhen configured for \"stealth\" monitoring, RealSpy employs significant surveillance capabilities:\n<ul>\n<li><strong>Comprehensive Keylogging:</strong> The software hooks into the Windows operating system at a low level to record every keystroke made by the user, explicitly including passwords, financial details, and private communications.</li>\n<li><strong>Screen and Clipboard Capture:</strong> It takes continuous or triggered screenshots of the user's desktop and logs the contents of the system clipboard.</li>\n<li><strong>Covert Exfiltration:</strong> The software can be configured to run completely hidden from the user (no system tray icon, hidden from Task Manager). It then exfiltrates the logged data to a cloud dashboard or via email to the person who installed it.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe unauthorized presence of RealSpy on a corporate endpoint is a critical breach of privacy and a massive data exfiltration risk. A commercial keylogger captures everything, bypassing encryption and multi-factor authentication (as it captures the data before it is sent or after it is decrypted on the screen).\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Investigate the Source:</strong> The presence of a commercial keylogger strongly implies an \"insider threat\" or unauthorized local access. HR and Legal teams should be involved to investigate who purchased the license and installed the software.</li>\n<li><strong>Credential Reset:</strong> All passwords typed on that machine while the software was active must be considered compromised. A global credential reset is required.</li>\n<li><strong>Uninstallation and Verification:</strong> The software can typically be uninstalled via the Control Panel (if the uninstaller is accessible) or removed using a reputable enterprise anti-malware solution. Ensure that the associated services and registry keys (`HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run`) are fully purged.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Riskware.RealSpy",
    "Keylogger.RealSpy",
    "Monitor.RealSpy"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1056.001",
    "T1113",
    "T1115",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-02T06:55:55Z",
  "type": "Riskware / Commercial Keylogger",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}