🛡️ Your Antivirus Can't Save You — The Real Anti-Keylogger Playbook for Windows

premiumvpnshield · February 6, 2026, 6:24pm

Detect Keyloggers Like a Forensic Analyst — ETW, Velociraptor & the NULLCON Method

OSK won’t protect you. Most “anti-keylogger” advice is a decade behind. Here’s what actually works in 2025.

The Windows On-Screen Keyboard stops exactly one type of keylogger — the most basic hook-based kind that your antivirus already catches. Meanwhile, there are at least 7 distinct keylogging methods, including ones that record your screen, listen to your typing sounds through your microphone, and read keystrokes from kernel memory before any app even sees them. Here’s the full defensive stack nobody talks about.

🪝 Why OSK Is a Band-Aid — The 7 Types of Keyloggers

The original tip isn’t wrong — it’s just dangerously incomplete. Here’s every method attackers use to steal your keystrokes, and which ones OSK actually blocks.

Type	How It Works	OSK Blocks It?	Detection Difficulty
Hook-based (SetWindowsHookEx)	Installs a global keyboard hook via DLL injection — every key event passes through attacker’s filter function	Yes	Easy — injected DLL visible in all processes
Polling-based (GetAsyncKeyState)	Loops through all 255 virtual keys every 50ms checking which are pressed	Yes	Medium — high API call frequency is detectable
Raw Input Model (RegisterRawInputDevices)	Registers as a background raw input sink — receives keystrokes directly from HID layer	No	Medium — RIDEV_INPUTSINK flag is suspicious
DirectInput	Uses legacy gaming input API to read keyboard state	No	Hard — looks like normal game input
Hotkey-based (RegisterHotKey)	Registers system hotkeys for every key, captures keystrokes, then emulates them back	No	Very hard — no ETW monitoring exists for this API
Kernel-mode driver	Filter driver sits in the keyboard driver stack (kbdclass.sys), captures scan codes before they reach any app	No	Very hard — runs at highest privilege
Screen capture	Takes periodic screenshots — reads whatever’s on screen, including password fields	No	Medium — unusual screen capture API calls
Acoustic	Records typing sounds via microphone, uses ML to reconstruct keystrokes at 92-95% accuracy	No	Nearly impossible from the victim’s side
Form grabber (browser-level)	Hooks browser functions to capture form data at submission — before encryption	No	Hard — runs inside browser process
Clipboard logger	Monitors clipboard for copy-paste of passwords	No	Easy — clipboard API monitoring

The math: OSK protects against 2 out of 10 methods. That’s a 20% defense rate. You need the full stack.

🔐 Layer 1: Keystroke Encryption — Stop Keyloggers at the Driver Level

These tools encrypt your keystrokes in the Windows kernel — before any hook, poll, or raw input reader can intercept them. Even if a keylogger captures your typing, it only gets encrypted garbage.

Tool	What It Does	Free Tier	Link
KeyScrambler	Encrypts keystrokes at kernel driver level in real-time. Free version covers all major browsers. Pro/Premium covers 200-500+ apps. 19 years in production.	Free (browsers only)	qfxsoftware.com
Ghostpress	Hides keystrokes system-wide by breaking low-level hooks. Portable — runs from USB. Includes anti-hook-overwriting protection and typing delay randomization.	Free (full)	schiffer.tech/ghostpress
ScreenWings	Blocks ALL screenshot capture system-wide — any screenshot taken while active returns a black image. Same developer as Ghostpress.	Free	schiffer.tech/screenwings

How KeyScrambler works under the hood: It installs a kernel-mode encryption driver that sits between your physical keyboard and Windows. When you press a key, KeyScrambler encrypts it immediately — before the keystroke enters the Windows message queue where hook-based and polling-based keyloggers intercept. The encrypted keystroke travels through the entire OS, and only gets decrypted inside the destination app. Any keylogger capturing in between sees only randomized characters.

Ghostpress vs KeyScrambler: Different approach, same goal. Ghostpress doesn’t encrypt — it hides your keystrokes by breaking the hook chain and suppressing low-level keyboard events from reaching unauthorized listeners. It also randomizes keystroke timing to defeat behavioral analysis (attackers can fingerprint you by how you type).

Combo move: Run Ghostpress (free, system-wide protection) + ScreenWings (blocks screen capture keyloggers) together. Both are portable — keep them on a USB for public/shared computers.

🧪 How to Test if Your Anti-Keylogger Actually Works

Download the SpyShelter Security Test Tool (AntiTest):

SpyShelter AntiTest (password: Spyshelter)
Your antivirus will flag it — it’s a false positive, allow/exclude it
Run it, type normally, and check what it captures
With Ghostpress/KeyScrambler active: it should capture only garbage characters or nothing
Without protection: it captures everything you type in plaintext

This is the real test. If your “protection” fails AntiTest, it fails against real keyloggers too.

🔬 Layer 2: Detecting Keyloggers Already On Your Machine

If you think you might already be compromised, here’s the forensic checklist — from the cutting-edge research presented at NULLCON Goa 2025 by Elastic’s Asuka Nakajima.

The 4 Keylogger Types and Their Detection Signatures

Keylogger Type	Windows API Used	ETW Event ID	Detection Signal
Polling-based	`GetAsyncKeyState`	1003	MsSinceLastKeyEvent > 100 AND BackgroundCallCount > 400
Hook-based	`SetWindowsHookEx`	1002	FilterType = WH_KEYBOARD_LL
Raw Input	`RegisterRawInputDevices`	1001	Flags = RIDEV_INPUTSINK (background capture)
Hotkey-based	`RegisterHotKey`	None	No ETW monitoring — requires kernel memory scanning

Source: Asuka Nakajima, NULLCON 2025 — “Windows Keylogger Detection: Targeting Past and Present Keylogging Techniques”

Free Detection Tools

Tool	What It Does	Link
Velociraptor (Windows.Detection.Keylogger artifact)	Open-source DFIR tool with a dedicated keylogger detection artifact that monitors Win32k ETW events for all 3 detectable keylogger types. Built directly from Nakajima’s NULLCON research.	docs.velociraptor.app
Elastic Defend 8.12+	EDR with built-in keylogger detection rules monitoring SetWindowsHookEx, GetAsyncKeyState, and RegisterRawInputDevices via Win32k ETW. Also detects hotkey-based keyloggers using undocumented kernel memory scanning of `gphkHashTable`.	elastic.co/security-labs
HotkeybasedKeyloggerDetector	Kernel-mode driver that scans `gphkHashTable` in win32kfull.sys to detect hotkey-based keyloggers — the only type invisible to ETW. Created by the same researcher.	GitHub

Manual Forensic Checklist (No Tools Required)

Task Manager → Details tab — sort by CPU. Any unknown process consuming consistent CPU could be a polling keylogger (they loop every 50ms)
Autoruns (Sysinternals) — check Logon, Scheduled Tasks, Services, Drivers tabs for anything unfamiliar. Keyloggers need persistence to survive reboot
Device Manager → Keyboards — more than one keyboard driver listed? Could be a kernel-mode keylogger filter driver
Physically inspect your USB ports — look for any adapter between your keyboard cable and the port. Hardware keyloggers are small inline devices, sometimes hidden inside USB hubs
Wireshark — if a keylogger is exfiltrating data, filter for unusual outbound connections on uncommon ports or to unknown IPs

🏦 Layer 3: Bypass Keystrokes Entirely — Password Managers & FIDO2

The strongest anti-keylogger move: stop typing passwords altogether.

Password Manager Autofill (Why It Beats Typing)

Password managers like Bitwarden, 1Password, and KeePassXC don’t type your password — they inject it directly into the browser’s form field via internal APIs. This bypasses:

Hook-based keyloggers (no keyboard event fires)
Polling-based keyloggers (no key state changes)
Acoustic keyloggers (no typing sound)
OSK loggers (no virtual keyboard clicks)

The catch: Clipboard loggers can still intercept copy-paste. Use autofill, not copy-paste. And form grabbers can still capture data at the browser level — which is why you need Layer 4 (hardening).

FIDO2 Hardware Keys (The Nuclear Option)

A YubiKey or similar FIDO2 security key uses cryptographic challenge-response authentication. No password ever crosses the keyboard. Even if every keylogger on Earth is running on your machine, the attacker gets nothing replayable.

FIDO2 Key	Price	Protocols	Best For
YubiKey 5 NFC	~$50	FIDO2, U2F, PIV, OpenPGP, OTP	Everything — most versatile
YubiKey Security Key	~$25	FIDO2, U2F only	Budget option, still phishing-resistant
Google Titan	~$30	FIDO2, U2F	Google ecosystem users
OnlyKey	~$50	FIDO2, U2F + hardware password manager	Stores passwords ON the device, types them for you

OnlyKey is the sleeper pick — it’s a FIDO2 key AND a hardware password manager. It stores up to 24 accounts directly on the device and types passwords for you via emulated keyboard output. The PIN is entered on the device itself, so even if a keylogger is running, it only sees the OnlyKey typing a pre-stored password — not you typing the master PIN.

Setup priority: Enable FIDO2 on your most critical accounts first — Google, Microsoft, GitHub, banking, password manager vault. One YubiKey + one backup key = keyloggers become irrelevant for those accounts.

🔧 Layer 4: Harden Windows Against Input Capture

These are OS-level defenses that prevent keyloggers from installing or operating in the first place.

Built-In Windows Defenses (Free, Already On Your Machine)

Defense	What It Stops	How to Enable
Memory Integrity (HVCI)	Prevents unsigned kernel drivers from loading — blocks kernel-mode keyloggers	Windows Security → Device Security → Core Isolation → Memory Integrity → ON
Credential Guard	Isolates Windows login credentials in a hypervisor-protected VM — even kernel-level keyloggers can’t read them	Enabled by default on Win11 22H2+ (Enterprise). Check: `Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard`
Secure Boot + TPM 2.0	Prevents firmware/UEFI keyloggers from loading before Windows starts	BIOS settings — usually enabled by default on modern hardware
Smart App Control (Win11)	Blocks unsigned/untrusted apps from running — prevents most keylogger installations	Windows Security → App & Browser Control → Smart App Control
AppLocker / WDAC	Whitelists only approved executables — nothing else runs, period	Group Policy (Enterprise) or `New-CIPolicy` PowerShell cmdlet

The Real Hardening Checklist

Turn on Memory Integrity — this single setting blocks almost all kernel-mode keyloggers. It prevents unsigned drivers from loading, which is how most advanced keyloggers operate. Some old drivers may be incompatible — Windows will tell you which ones
Run as Standard User — not admin. Kernel-mode keyloggers require admin/system privileges to install. A standard user account is the simplest, most effective barrier
Disable unnecessary USB ports (Group Policy: Computer Configuration → Administrative Templates → System → Removable Storage Access → Deny All) — prevents hardware keyloggers from being plugged in on shared/public machines
Enable PowerShell Constrained Language Mode — prevents fileless keyloggers that inject via PowerShell scripts
Keep Windows + drivers updated — the VBS spoofing vulnerability (CVE-2025-48813) in October 2025 showed that even Credential Guard can be bypassed if you don’t patch

🎤 Layer 5: The Threats Nobody Mentions — Acoustic & Screen Capture

Acoustic Keyloggers — Your Microphone Is a Keylogger

In 2023, British university researchers trained a deep learning model that reconstructs what you type by listening to your keyboard sounds — with 95% accuracy from a nearby smartphone microphone and 93% accuracy over a Zoom call.

Each key on your keyboard makes a slightly different sound based on its position, the mechanical structure underneath, and how your fingers strike it. ML models (spectrogram analysis via MFCC + vision transformers like ConvMixer) can map these sound signatures to individual keys.

Defenses:

Use a silent/low-profile keyboard (reduces acoustic signature differentiation)
Mute your microphone when not actively speaking on calls
Play background noise/white noise while typing sensitive info — degrades ML model accuracy significantly
Use password managers with autofill — no typing = no sound
Mechanical keyboards are actually MORE vulnerable (louder, more distinct per-key sounds)

Screen Capture Keyloggers

Advanced keyloggers take screenshots every few seconds, or specifically when they detect password-field focus. Your carefully protected keystrokes don’t matter if the attacker can just… see your screen.