Explanatory notes
The table reflects how the monitoring application has performed during the tests carried out by our team.
The overall rating is calculated on the basis of how the applications have scored within the following groups:
Also Read: 27 Cool Mac Tips & Tricks You Probably Don’t Know. Overall, keyloggers are evasive. There are strong chances that you fail to identify and terminate a keylogger on Mac due to their property of being camouflaged. However, practicing the above steps would significantly help you. These free Mac keyloggers have been tested on all current versions of Mac OS X 9 and 10 and although not as solid as the best Mac keylogger (paid), they get the job done. While all the Mac keyloggers on this site have been tested for discretion, simplicity and the value of the information gathered, they are all slightly different as each users. Elite Keylogger for Mac is the best keylogger for recording keystrokes. All words typed on websites, emails, chats and instant messages are captured. Capture usernames and passwords. Use password tracking to monitor social networks like Facebook, Twitter, or Instagram. Not every password can be recorded on OS X 10.11+. Track screenshots.
OS Support - this group reflect the number and quality of the operation systems supported by the applications.
- Mac OS X 10.5 Leopard — support of Mac OS X 10.5 Leopard operation system
- Mac OS X 10.6 Snow Leopard — support of Mac OS X 10.6 Snow Leopard operation system
- Mac OS X 10.7 Lion — support of Mac OS X 10.7 Lion operation system
- OS X 10.8 Mountain Lion — support of OS X 10.8 Mountain Lion operation system
- OS X 10.9 Mavericks — support of OS X 10.9 Mavericks operation system
- OS X 10.10 Yosemite — support of OS X 10.10 Yosemite operation system
- OS X 10.11 El Capitan — support of OS X 10.11 El Capitan operation system
- macOS 10.12 Sierra — support of macOS 10.12 Sierra operation system
- macOS 10.13 High Sierra — support of macOS 10.13 High Sierra operation system
Security — this group shows how hidden the application is and what self-protection mechanisms it has.
- Invisible after installation — monitoring app receives mark in this section if it cannot be found by means available to average user after it was installed
- Password protection — ability of monitoring app to be password-protected
- Accessed by keyword — ability of monitoring app to be accessed by typing a pre-specified keyword
- Accessed by hotkey combination — ability of monitoring app to be accessed by pressing a pre-specified hotkey combination
- Configurable self-removal — ability of monitoring app to be self-removed on a pre-specified date or under any other pre-specified conditions
- Configurable warning message — ability of monitoring app to show a configurable warning message on system's startup
Monitoring — this group analyzes what monitoring functions an applications has, such as keystroke, clipboard, login passwords, etc monitoring.
- System logon (password) — ability of a keylogger to intercept the logon password
- Alphanumeric keys pressed — ability of a keylogger to intercept alphabetic and numeric keys pressed
- System keys pressed — ability of a keylogger to intercept pressed system keys
- Created files — ability of a keylogger to record the fact of files' creation
- Deleted files — ability of a keylogger to record the fact of files' deletion
- Renamed files — ability of a keylogger to record the fact of files' renaming
- Opened files — ability of a keylogger to record the fact of files' opening
- Clipboard — ability of a keylogger to intercept clipboard content
- Started applications — ability of a keylogger to record started applications
- System logon — ability of a keylogger to record time when a user logs on
- System logoff — ability of a keylogger to record time when a user logs off
- Printer queue — ability of a keylogger to record the fact of documents' printing
- Mouse clicks — ability of a keylogger to intercept the mouse-clicks made, including the information about the buttons pressed and places clicked on
- Sounds — ability of a keylogger to intercept the sounds played or recorded
- System inactivity time — ability of a keylogger to record the period of user's inactivity time
- Screenshots — ability of a keylogger to make screenshots
- Adjustable screenshot frequency — mark in this section means that a user can configure an interval of screenshots making
- Adjustable screenshot quality — mark in this section means that a user can set the quality of screenshots to be made by a keylogger
- Desktop or window shot option — mark in this section means that a user can choose whether he wants the screens of the entire desktop or of an active window only to be made
- On-mouse-click screenshots — ability of a keylogger to make a screenshot every time any of the mouse buttons is pressed
Online Monitoring — the group that reflects availability of the functions to monitor users’ online activity, such as URLs visited, 2-side chat conversations interception and emails sent/received.
- URLs opened in Safari — ability of online activity monitoring software to log websites opened in Safari browser
- URLs opened in Firefox — ability of online activity monitoring software to log websites opened in Firefox browser
- URLs opened in Chrome — ability of online activity monitoring software to log websites opened in Chrome browser
- URLs opened in Opera — ability of online activity monitoring software to log websites opened in Opera browser
- Emails in Mail — ability of online activity monitoring software to record both outgoing and incoming emails sent or received using Mail software
- Screenshots of visited web-sites — ability of online activity monitoring software to make a screenshot every time a new website is opened
- YahooIM chats (2-side) — ability of online activity monitoring software to intercept both sides of chat conversations made in Yahoo Instant Messenger
- AIM chats (2-side) — ability of online activity monitoring software to intercept both sides of chat conversations made in America Online Instant Messenger
- Messages (Bonjour) chats (2-side) — ability of online activity monitoring software to intercept both sides of chat conversations made in Messages (Bonjour) chat text conversation
- Skype chats (2-side) — ability of online activity monitoring software to intercept both sides of chat conversations made in Skype chat text conversation
Reports — the group that basically analyzes the convenience of the intercepted information reading, including not only the ways to filter and show it, but also to deliver it remotely.
- Monitoring certain users option — mark in this section means that a user can set which of Mac users to monitor
- Events duration — ability of a keystroke logger app to record the duration of some of the events (e.g. duration of the time spent on a website, etc.)
- Monitoring certain apps option — mark in this section means that a user can specify which of the app to monitor
- Search by keywords — mark in this section means that a user can perform a search by keywords in log-files
- Several days report building — mark in this section means that a keystroke logger app allows its user to set a period of days he wants to see the intercepted information for
- Logs sent via email — ability of a keystroke logger app to send log-files to a specified email address
- Logs sent via FTP — ability of a keystroke logger app to upload log-files to FTP-server
- Logs sent via LAN — ability of a keystroke logger app to save log-files to a shared resource in LAN environment
- Logs copied to a portable device — ability of a keystroke logger app to instantly copy log-files to a portable device (flash drive)
- Maximum log-files' size — ability of a keystroke logger app to start recording the information intercepted to another log-file after the current one reaches a pre-specified size
- Automated clearance of log-files — ability of a keystroke logger app to configure the conditions under which the log-file is cleared (e.g. time period, file size, number of keystrokes intercepted, etc.)
Other — other functions that cannot be part of any of the other groups listed, though a still very important such as parental control functions, languages, reactions to specific keywords, etc.
- Reaction to a specific keyword — ability of the software to somehow react when a user being monitored types a keyword from a pre-specified list (e.g. to send an email, show a warning message, turn Mac off, etc.)
- Monitoring scheduler — mark in this section means that a keylogger can be configured to work on schedule (i.e. log the user's actions only on holidays, or on from 12.00 a.m. to 3.00 a.m. onle, etc.)
- Programs' blocking — ability of a keylogger to block pre-specified programs from launching
- Websites' blocking — ability of a keylogger to block pre-specified websites from opening
- 5+ languages — mark in this section means that keylogger's interface is available in 5 or more languages
- 2-5 languages — mark in this section means that keylogger's interface is available in at least 2, but not more than in 4 languages
To find out in a more detailed way how the scores are calculated within the groups and how the testing is performed please follow the Testing Policy.
Every month or so I get scam messages demanding payments in Bitcoins for the images of me they allegedly took using my webcam. They claim that they use keyloggers to control my computer.
So, how to know if your Mac has a keyLogger? There are two types of keyloggers: hardware and software. Examine external USB devices connected to the Mac for hardware keyloggers. Use Activity Monitor to look for unknown processes when checking for software keylogger. Check Privacy options in System Preferences for applications with too much privileges. Install tools such as Malwarebytes and MacScan and scan computer.
How do Keyloggers Work
Keylogger or keystroke logger is a spyware application that runs invisibly for users and logs (saves on the local disk or sends to the cloud) every key that users press on the computer.
Usually, keyloggers are used by hackers to collect your credit card information you enter on various web sites. They also collect your usernames and passwords, so they can steal money from your bank accounts.
The goal of a keylogger is not to collect information for as long as possible, that’s why you may never know that it was installed.
It does not suddenly slow down your computer (unless it is sending information over the internet), it does not pop up scary messages in Safari or Chrome, it does not redirect your browser to wrong web sites. It just quietly hides on your computer and gathers your data in order to use it later.
How keyloggers get installed
Typically, they get installed as part of free software you download from the Internet. The free software may contain a keylogger code inside of it so the former installs the latter on the computer.
Once installed the keyloggers starts collecting information and sends it to storage in the cloud where the hacker can access it. Keyloggers can also be installed as browser extensions.
Hardware keyloggers
There are two types of keyloggers: hardware and software. While hardware keyloggers apply mostly to desktops they are impossible to detect with the software. The hardware keylogger is usually attached to the computer and a keyboard is attached to the device. Download for sims 4 mac.
Every time you press a key on the keyboard the device records it in its local storage and then passes the key information to the computer. If you want, you can buy a hardware keylogger on Amazon.
Software-based keystroke loggers are much more powerful because they run on the computer itself and they have access to the entire computer, not just a keyboard.
Is Keylogger Malware?
A keylogger can be either malware, like rootkit, or legitimate software installed on your computer. Commercial applications that log the keyboard input on the computer can be installed by parents who want to monitor which sites their children are visiting on the Internet. Or the company may want to track employee activities.
Believe it or not, you can easily download and install a keylogger on your own Mac. Most popular keyloggers for Mac OS are:
- Perfect Keylogger for Mac
Besides recording key presses these tools are capable of capturing screenshots, data in the clipboard, keep web browsing history.
In case of chat applications such as Skype, Viber or iMessage they can log messages from both sides: anything typed on your computer and incoming chat messages.
Some keyloggers are equipped with geolocation features. If the MacBook was stolen, they can be used to track it down because they will secretly send keystrokes and screenshots to the cloud. Keyloggers can also control your webcam and record videos or you can watch live from another computer.
You decide if it is ethical or legal to spy after children, spouse or employees. The goal of this article is to educate people about possibilities and describe ways to protect yourself from spying.
How to Install a Keylogger on Mac
To test how MacScan and Malwarebytes are capable of finding keyloggers I decided to install all four keyloggers on my Mac.
IMPORTANT: I don’t endorse any keylogger here. Moreover, if you want to avoid getting malware on your Mac, do not download software from anywhere except Apple App Store. Personally, I do not trust any of the above-mentioned keyloggers, so before installing them on my MacBook I did the following:
- Took a backup of my drive
- Reset MacBook to factory settings
- Installed and tested keyloggers so I can report my findings here
- Restored everything from the backup.
There is something fundamentally sleazy about spying after other people. No wonder that installing a keylogger reminded me of installing apps with potential viruses in it.
Elite Keylogger sent me to a jumpshare url, it didn’t let me download from their site. The problem I had with installing Elite is that its installer did not want to close, so I had to force shutdown my Mac. Check here if you want to know more about potential issues with force shutdowns.
The Perfect Keylogger sent me two emails: one with the link from which I could download an encrypted zip file and another with the password for the zip file. Google immediately flagged both messages as dangerous spam.
Spyrix and Aobo didn’t have such problems and Refog looked like a legit app with a proper installer. The interesting thing is that I was able to install all 5 of them at the same time and all four of them were recording keystrokes.
Does Malwarebytes or MacScan detect keyloggers?
Once I installed Malwarebytes it immediately recognized Elite keylogger as malware and put into quarantine. It was also able to detect Aobo and Refog. Unfortunately, it didn’t find anything wrong with Perfect Keylogger and Spyrix.
MacScan was more successful: it found 4 out of 5 apps, but it still missed Perfect Keylogger.
Conclusion: If you want to install a keylogger on your Mac go with Perfect one from Blazing tools. It didn’t get detected by either Malwarebytes or MacScan.
But again, do it at your own risk. If you ask my opinion, I would never install such an application on the computer where I entered my credit card information or password to my bank accounts.
On the other hand, I was disappointed with Malwarebytes and MacScan missing some apps. This experiment does not give me high confidence in malware protection tools.
So, what would I recommend you do if you believe that there is a keylogger app on your MacBook? Reset and reinstall your MacOS and immediately change all passwords for all web sites you were using.
Keylogger myths
Some people suggest a couple of workarounds that in their opinion can trick keyloggers. One of them is to use software-based keyboards. You can start such a keyboard by going to System Preferences and clicking on the “Keyboard” icon.
In “Input Sources” tab click on “Show input menu in menu bar”. Once you do it you can see a keyboard icon in the top bar near the battery icon. Download mysql for mac os. If you click on that icon and select “Show Keyboard Viewer” it will bring a software keyboard which you can use to type information and which supposedly will not be tracked by a keylogger.
Another workaround is to type a part of the password or the credit card number in the browser, then bring up a text editor, type a garbage text in it, switch back to the browser and type the second part of the secret password.
These workarounds possibly worked a long time ago when malware was not sophisticated, but now when they can take screenshots and have some intelligent software, I would not rely on the workarounds anymore.
How to Detect Keylogger on Mac with Activity Monitor
Some people suggest checking for malware in Activity Monitor. The typical suggestion is to bring up the Activity Monitor and find the application that looks suspicious or you do not recognize.
This advice may work for someone who knows all applications running on Mac, but for an average user, all applications running on Mac are unfamiliar.
I am not claiming this is impossible however. For instance, Spyrix Keylogger appear in Activity Monitor as skm, and Perfect Keylogger as DashboardClient.
What to do when getting a scam email?
As said in the beginning everyone is getting emails which state that they set up malware on the certain web sites and “your browser began working as a RDP that has a key logger which provided me access to your display as well as cam”. It continues with a threat to send embarrassing information to your friends unless “you will make the payment via Bitcoin”.
Normally, these emails end up in a Spam folder, but if you are using an email other than Gmail chances are that they will appear in your Inbox. So, what should you do in this case? The answer is to Delete the email. This is called extortion
The hackers send such emails to millions of people with the hope that someone will be scared and will pay a ransom. They do not install keyloggers, it is cheaper to scare people by sending emails then target specific people.
Mac Os Keylogger
How to Detect Commercial Keyloggers on Mac?
If you suspect that someone you know (your employer, spouse, parent, friend or enemy) is spying after you chances are that they installed one of the commercial keyloggers.
There is very little chance that they were able to find a malware soft built by hackers to infect your system because the malware will be sending your information to the hacker, not your personal enemy.
If you are looking to find if commercial keyloggers have been installed on your Mac, there are three ways to find: using Activity Monitor, checking default key combinations and checking the list of application with Full Disk Access.
Using Activity Monitor
Activity Monitor is still a good way to quickly find applications as long as you know their names:
- Perfect Keylogger appears as DashboardClient in the monitor
- Spyrix as skm
- Look for ‘coreservicesd’ to find Aobo
- Check for ‘Elite Keylogger’ when searching Elite Keylogger. However, the version I installed was free and it did not hide, so I don’t know how the process name will change for someone who buys a product.
- And finally, ‘Refog’ appears as ‘syslogd’
Note: there are legit services called ‘syslogd‘ and ‘coreservicesd‘, so their presence doesn’t necessarily mean that you have a keylogger. To find out if the Mac was infected, scan it with the free version of Malwarebytes.
Using default key combinations
All keyloggers have secret key combinations which will bring them from the place they are hiding to the screen. After all, if you can get to the data collected by a keylogger it is pretty much useless.
Default key combinations for keyloggers are:
But, what if whoever was installing the spyware was smart enough to change the default key combination. Then you won’t be able to find keyloggers by a key combination.
Check which applications have Full Disk Access
In order to do their job, most keyloggers must have full access to the disk or accessibility option.
Go to System Preferences -> Security and Privacy, click on the Privacy tab and check two sections: Accessibility and Full Disk Access.
Here how it may look like on your Mac if the app was installed:
How to Detect Malware Keystroke Loggers on Mac?
If you think that your Mac was infected by a keylogger when you’ve been browsing the internet or opened an email then steps above will not help because hackers do not use commercial keyloggers as malware.
You can still try to open the Activity Monitor, go over each process in it and search Google for the process name. This way, you can at least eliminate the good applications from the keyloggers (note, however, a good process can still be infected with a malware which installs a keylogger on Mac).
Free Keylogger For Mac Os X
For instance, if you don’t know what “cloudd” process is on Mac then Google following:
cloudd mac
The first response will say something like “This process is part of macOS and is related to iCloud”. So now you can move to the next process in the list.
Another option is to install Malwarebytes, MacScan, Intego Mac Internet Security or another antivirus and antimalware application. Some people suggested ReiKey for keystroke logger detection, but last time I checked the code was not updated for more than 8 months, which means is not being actively maintained.
And finally, the best way to get rid off a malware is remove the macOS and reinstall everything from scratch.
Other resources:
If you still feel that you are being watched then:
Recoverit Data Recovery has a vast presence in over 160 countries and is actively used by more than 5 million people. It is extremely easy to download Recoverit 9.0 free version on one's Mac or Windows PC. The existing users of the application can just upgrade their Recoverit 8.5 to the latest version for free. On the other hand, new users can.
- buy a webcam cover: recommended webcam covers for MacBooks
- check my other article:How to Tell if Someone is Remotely Accessing Your Mac
Free Keylogger For Mac
Topics:
Osx Keylogger
Image Credit: Flikr