Spyware
Covertly monitors activity and steals passwords, financial and personal data
categoryMalwareseverityHighdetectabilityHighlabnot yet measured
Example: DarkHotel; Pegasus (mobile)
Classification
31 values: 16 imported, 2 derived, 13 machine-classified. What do these mean?
Exploitability
| Attack vector | Credential attacksMalware |
|---|---|
| Reach (CVSS) | Local |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Active |
| Attacker skill required | Medium |
| Resources required | Medium |
| Likelihood / prevalence | High |
| Maturity | Established |
Impact & scope
| Severity | High |
|---|---|
| Impact | Confidentiality |
| Platform | LinuxmacOSNetwork DevicesWindows |
| Environment | MobileOn-premises |
| Target asset class | Endpoint |
| Kill-chain phase (tactic) | CollectionCredential Access |
Detection & telemetry
| Detectability | High |
|---|---|
| Testability | Atomic Red Team test |
| Data sources (ATT&CK data components) | File AccessFile ModificationNetwork Connection CreationNetwork Traffic ContentOS API ExecutionProcess AccessProcess Creation |
Detection & response
Mitigated by 13
D3-AVEd3fendD3-HCId3fendD3-IDAd3fendD3-IOPRd3fendD3-MBTd3fendD3-PCSVd3fendD3-PSEPd3fendD3-RHd3fendD3-RSd3fendD3-SAORd3fendD3-SBVd3fendD3-SUd3fendD3-SWId3fend
Detected by 9
- DET0102 attack-detection-strategy
34f90d3c-c297-49e9-b26d-911b05a4866csigma49aae26c-450e-448b-911d-b3c13d178dfcsigma60f1ce20-484e-41bd-85f4-ac4afec2c541sigma965e2db9-eddb-4cf6-a986-7a967df651e4sigma9ae01559-cf7e-4f8e-8e14-4c290a1b4784sigmac9192ad9-75e5-43eb-8647-82a0a5b493e3sigmadf68f791-ad95-447f-a271-640a0dab9cf8sigmaeb6c2004-1cef-427f-8885-9042974e5eb6sigma
Tested by 12
0e59d59d-3265-4d35-bebd-bf5c1ec40db5atomic2b162bfd-0928-4d4c-9ec3-4d9f88374b52atomic76628574-0bc1-4646-8fe2-8f4427b47d15atomic7f85a946-a0ea-48aa-b6ac-8ff539278258atomic81d7d2ad-d644-4b6a-bea7-28ffe43beccaatomic9c6bdb34-a89f-4b90-acb1-5970614c711batomica668edb9-334e-48eb-8c2e-5413a40867afatomicaee3a097-4c5c-4fff-bbd3-0a705867ae29atomicb04284dc-3bd9-4840-8d21-61b8d31c99f2atomicb7037b89-947a-427a-ba29-e7e9f09bc045atomicd9b633ca-8efb-45e6-b838-70f595c6ae26atomicde1934ea-1fbf-425b-8795-65fb27dd7e33atomic
Attack relationships
- Child: Credential-harvesting page / web portal capture
- Child: Hardware keylogger
- Child: Keylogger
Framework references
- Primary source: https://www.crowdstrike.com/en-us/cybersecurity-101/malware/types-of-malware/
- attack: T1056 (primary)
Evidence & sources
- ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Malware' table, line 86 of Cyber-Attack-Taxonomy.md
- ev-0002 (Seeded-record enrichment run 2026-09-30 (crosswalk + facet classification)) — Crosswalk to attack:T1056 as the nearest framework entries; ids verified to exist in the cached catalogues.
- ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 12 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)