HawkEye Keylogger

Aliases: HawkEye, HawkEye Reborn, Predator Pain

First seen
2013-01-01 00:00:00
Malware type
keylogger, credential-stealer, loader
Family
Malware family
Last IoC activity
2026-07-22 03:55:48
Profile updated
2026-07-07 12:59:53

Targeted industries: financial-services professional-services technology-and-telecommunications retail-and-hospitality

Context

HawKeye is a keylogger that is distributed since 2013. Discovered by IBM X-Force, it is currently spread over phishing campaigns targeting businesses on a worldwide scale. It is designed to steal credentials from numerous applications but, in the last observed versions, new "loader capabilities" have been spotted. It is sold by its development team on dark web markets and hacking forums.

Used by threat actors

Related threat objects

Reports & references

  • secureworks.com — Gold Galleon How A Nigerian Cyber Crew Plunders The Shipping Industry (report)
  • secureworks.com — Gold Galleon (report)
  • Kaspersky — 91897 (report)
  • labs.bitdefender.com — 5 Times More Coronavirus Themed Malware Reports During March (report)
  • ciphertechsolutions.com — Roboski Global Recovery Automation (report)
  • securityintelligence.com — Roboski Global Recovery Automation (report)
  • secureworks.com — Gold Galleon (report)
  • research.checkpoint.com — Following The Scent Of Trickgate 6 Year Old Packer Used To Deploy The Most Wanted Malware (report)
  • Cisco Talos — Rats And Stealers Rush Through Heavens (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Hawkeye Keylogger (report)
  • cyberbit.com — Hawkeye Malware Keylogging Technique (report)
  • Microsoft — Hawkeye Keylogger Reborn V8 An In Depth Campaign Analysis (report)
  • any.run — Hawkeye Malware Technical Analysis (report)
  • fortinet.com — Hawkeye Malware Analysis (report)
  • blueliv.com — Covid 19 Cybercrime M00Nd3V Hawkeye Malware Threat Actor (report)
  • researchcenter.paloaltonetworks.com — Surveillance Malware Trends Tracking Predator Pain And Hawkeye (report)
  • Cisco Talos — Hawkeye Reborn (report)
  • github.com — Hawkeye.Md (report)
  • Mandiant — Hawkeye Malware Distributed In Phishing Campaign (report)
  • cyberbit.com — Hawkeye Malware Keylogging Technique (report)
  • stopmalvertising.com — Analysis Of The Predator Pain Keylogger (report)
  • govcert.ch — Analysis Of An Unusual Hawkeye Sample (report)
  • nakedsecurity.sophos.com — The Hawkeye Attack How Cybercrooks Target Small Businesses For Big Money (report)
  • trustwave.com — How I Cracked A Keylogger And Ended Up In Someone S Inbox (report)

External references