KeyBase
Aliases: Kibex
- First seen
- 2015-02-01 00:00:00
- Malware type
- credential-stealer, keylogger
- Family
- Malware family
- Last IoC activity
- 2026-07-22 02:13:47
- Profile updated
- 2026-07-07 15:08:22
Context
KeyBase is a .NET credential stealer and keylogger that first emerged in February 2015. It often incorporates Nirsoft tools such as MailPassView and WebBrowserPassView for additional credential grabbing.
Reports & references
- malpedia.caad.fkie.fraunhofer.de — Win.Keybase (report)
- virusbulletin.com — New Keylogger Block (report)
- Palo Alto Unit 42 — Keybase Keylogger Malware Family Exposed (report)
- isc.sans.edu — 22011 (report)
- th3l4b.blogspot.com — Keybase Loggerclipboardcredsstealer (report)
- voidsec.com — Keybase En (report)
- Palo Alto Unit 42 — Keybase Threat Grows Despite Public Takedown A Picture Is Worth A Thousand Words (report)
- community.rsa.com — Malspam Delivers Keybase Keylogger 2 11 2017 (report)
- researchcenter.paloaltonetworks.com — Keybase Keylogger Malware Family Exposed (report)