Top tips: Protect yourself from the threat that reads every word you type
Top tips is a weekly column where we highlight what's trending in the tech world and list practical ways to explore these trends. This week, we are tackling a lesser-known but growing cybersecurity risk in modern workplaces: keylogger-based attacks.
Marcus had a good Monday: A deal closed, and he had an early finish. Before logging off, he did what he always did: checked his bank account, replied to a few emails, and updated his LinkedIn profile—normal, forgettable stuff.
By Wednesday, his bank account was being drained in a city he'd never visited. By Friday, he was locked out of his email. By the following Monday, his company's client database had been accessed using his credentials, and the HR team wanted a meeting.
He had, three weeks earlier, downloaded a free PDF converter. That was all it took.
The threat that doesn't announce itself
Hidden inside that download was a keylogger—silent, invisible, and recording every keystroke. For three weeks, it sat on Marcus' laptop like a shadow, recording everything and sending it to someone he would never meet. It didn't crash his system, slow things down, or announce itself. That's the whole point.
Here are seven things that Marcus should have done and that you can start doing today:
1. Pay attention when your device feels different
Three weeks before Marcus' world unraveled, his laptop had been trying to tell him something: a slight typing lag, a flickering hard drive light, and a slower startup than usual. He ignored all of it.
A sluggish startup, a typing lag, an erratic cursor, and a blinking hard drive—these are the quiet tells of a keylogger. None feel urgent in isolation. Together, they are a warning. The next time your device feels slightly off, investigate.
2. Review your active processes regularly
Marcus' task manager would have told him everything had he looked. Buried in the list of running processes was a program with a name that looked almost legitimate but wasn't.
Keyloggers are designed to blend in, borrowing names that look routine at a glance. Open your task manager. If something looks unfamiliar, it probably is. Ten seconds of checking could save you months of recovering.
3. Check what launches when you start up
Every morning when Marcus powered on his laptop, the keylogger woke up with him. Some keyloggers embed themselves into the startup list, recording from the moment the device switches on.
In Windows, the Startup tab in Task Manager shows everything set to run upon a boot. It takes 30 seconds to check. Marcus never once looked. Make it a habit.
4. Monitor your outgoing network connections
While Marcus worked, the keylogger wasn't just collecting. It was sending. Passwords, messages, and login credentials were all quietly packaged and transmitted to a remote server without a single notification.
ManageEngine OpManager tracks network activity in real time, making it possible to spot a program communicating with an unknown server on a schedule. If you see something you don't recognize making regular outbound connections, find out what it is.
5. Run a dedicated malware scanner
Marcus had antivirus software. It was up to date. He felt covered. He wasn't.
Keyloggers are built to stay below the radar of standard antivirus tools. ManageEngine Malware Protection Plus uses deep learning and behavioral analysis to detect threats that hide quietly for weeks, and ManageEngine Endpoint Central catches them before they are even executed. Your antivirus software is the lock on the front door. These tools check whether someone is already inside.
6. Turn on multi-factor authentication
When the attacker used Marcus' stolen passwords, they logged straight in—no friction and nothing to stop them.
Had Marcus enabled multi-factor authentication (MFA), those stolen passwords would have been useless. Even when a keylogger captures everything, MFA blocks the attacker with a prompt for a second verification factor they simply don't have. Enable it on every account that matters before you need it.
7. Be ruthless about what you download
Everything that happened to Marcus started with one download: a free PDF converter, a website that looked professional, and a moment of not quite thinking it through.
Keyloggers arrive through malicious websites, email attachments, and free downloads. The free tool, the cracked software, and the handy browser extension—these are open doors. No security tool in the world compensates for walking through one carelessly.
A crisis that could have been prevented
It took Marcus four months to recover. New bank accounts, reset passwords, a workplace investigation, and a difficult conversation with a client whose data had been exposed all came from one free download.
The keylogger was tiny: a few lines of code that cost nothing to plant and everything to fix. The most unsettling thing about keyloggers isn't how sophisticated they are. It's how patient they are.
Check your processes. Review your startup list. Run regular scans. Enable MFA. And think twice before downloading something just because it's free.
Marcus' Wednesday was ordinary right up until it wasn't. Yours doesn't have to end the same way.