I read Kaspersky statistic and I saw this image : enter image description here

Why would keyloggers be used for stealing money less often than banking malware?

2 Answers 2


The main reason could be the attack vectors used to spread them.

You can read from the documentation you linked to that malware banking (trojans mainly) are quite easily spread via spams and or by intercepting the user's payment data after injecting random HTML code in the web page displayed by the browser (if you read The Emperor’s New Security Indicators: An evaluation of website authentication and the effect of role playing on usability studies, you will notice even most bank users who are taught additional instructions to behave securely are trapped easily by attackers).

Whereas it can be more complicated to fulfill the same goal with the use of keyloggers. If you look how some bank keyloggers have been a successful attack you will notice it is quite difficult for the attack to take place. It is the case, for example, for the famous Sumitomo bank keylogger that was successful only after a cleaning staff placed hardware bugs onto the keyboard sockets at the back of the bank's computers where they could not be seen and then reattached the keyboards and this gang are understood to have also got around the bank's 24 hour video surveillance of its offices as tapes that would have shown the cleaners at work have now been found to be blank. As you can see, this keylogger needed more resources (human, mainly) to be successful.

  • you say in this image kelogger means keylogger without a trojan or rootkit,yes ? Oct 16, 2015 at 8:13
  • There are keylogger trojans but it is not the case with the successful example I mentioned
    – user45139
    Oct 16, 2015 at 8:22

Because simple keyloggers give you a lot of data which is not related to your actual goal. When you just blindly record all keypresses of the user, you get lots and lots of text, lots and lots of repeated keypress input from games they play and maybe somewhere in between a valid username and password. To find something interesting in keylogger output, a human usually has to examine the data manually. If you are lucky: many users use password managers so they don't actually type their passwords.

But online baking fraud is an industry which operates on large scales. They try to automatize what they can so they can attack as many targets as possible with minimal human effort. That's why they prefer specialized software which only gets the data they actually need and use it automatically without requiring any human interaction. Also known as specialized banking malware.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .