{
  "family": "stalk",
  "sample_count": 2,
  "category": "advanced_threat",
  "description": "Riskware:Win32/Stalk is a generic heuristic detection used by antivirus engines to flag commercial 'employee monitoring', 'parental control', or 'stalkerware' applications. While these tools can be purchased legally and ostensibly have legitimate use cases, their core functionality is identical to highly malicious spyware and keyloggers. Threat actors, advanced persistent threats (APTs), and insider threats frequently weaponize these commercial tools to bypass AV and spy on users.<br><br><b>Understanding Stalk (Stalkerware/Keyloggers)</b><br>To an end-user, the presence of a Stalk implies they have zero privacy; every keystroke, email, and website visited is being recorded. For a security analyst, this detection requires immediate investigation. If the IT department did not authorize the installation (e.g., for DLP monitoring), it indicates an active breach, an insider threat, or severe user policy violation (`T1056.001`).<br><br><b>Execution and Espionage Mechanics</b><br>These tools are typically installed manually by someone with physical access to the machine, or deployed silently via an MDM or Group Policy if authorized by IT. Once installed (`T1547.001`), they operate deep within the OS. They utilize Windows API hooking (like `SetWindowsHookEx`) to capture all keystrokes (`T1056.001`), periodically take screenshots (`T1113`), and monitor clipboard contents (`T1115`). Because they are 'legitimate' commercial software, they are often digitally signed and attempt to hide their processes from the standard Task Manager, silently uploading the harvested data to a cloud dashboard controlled by the installer.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a total loss of confidentiality for the endpoint. Host-based IoCs include EDR alerts for 'Suspicious API Hooking' (specifically keyboard hooks). The presence of hidden directories in `C:\\ProgramData` or `AppData` containing massive, encrypted log files or thousands of screenshots is a definitive indicator. Network IoCs include continuous, encrypted outbound traffic to known domains associated with commercial stalkerware vendors (e.g., FlexiSPY, mSpy, ActivTrak).",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1113",
    "T1056.001",
    "T1115"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging (Primary function)",
      "tactic": "Collection"
    },
    {
      "id": "T1113",
      "name": "Screen Capture (Recording desktop activity)",
      "tactic": "Collection"
    },
    {
      "id": "T1115",
      "name": "Clipboard Data (Capturing copied passwords)",
      "tactic": "Collection"
    }
  ],
  "containment_steps": [
    "Immediately verify with the HR and IT departments if the flagged monitoring software is authorized for use on that specific endpoint.",
    "If unauthorized, isolate the endpoint immediately; all typed passwords and viewed documents are actively being exfiltrated.",
    "Mandate an immediate password reset for the affected user, as all credentials used on that machine have been compromised.",
    "Uninstall the software using standard administrative tools, and run a full AV scan to ensure no hidden persistence mechanisms remain."
  ],
  "what_to_avoid": [
    "Do not ignore the alert simply because the software is commercially available; stalkerware is a massive security and privacy risk.",
    "Avoid confronting the user directly if an insider threat is suspected; follow standard HR and Legal incident response protocols."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}