How to check a laptop for a keylogger (Windows and Mac)

What a keylogger is, and the two kinds

A keylogger records what you type. A software keylogger is a program running on the laptop. A hardware keylogger is a small device that sits between a keyboard and the computer.

Software keyloggers are the common threat on laptops. They arrive with malware, with “monitoring” apps an abusive partner or employer installs, or bundled with pirated software. Commercial products sell themselves this way. StarLogger, the tool at the center of a 2011 scare, was advertised as “completely undetectable” and able to email its logs to any address, according to Ars Technica’s write-up at the time.

Hardware keyloggers work differently. Wikipedia’s summary describes a microcontroller plus flash memory, plugged inline on a USB or older PS/2 keyboard cable. Because the device doesn’t depend on the operating system, antivirus software can’t see it. They’re often made to look like an ordinary adapter. On a laptop’s built-in keyboard there is no cable to tap, so this risk mostly applies when you use an external keyboard.

Type	Where it hides	Will antivirus find it?	How you find it
Malware keylogger	Running program, often set to launch at startup	Usually, if the signature is known	Full and offline scans, startup list
“Monitoring” or stalkerware app	Installed by someone with access, often under a bland name	Sometimes	Permissions lists, unfamiliar apps, scans
Inline hardware logger	Between an external keyboard and a USB port	No	Look at the plug and cable
Keyboard or firmware modification	Inside the keyboard or the BIOS	No	Hard to check at home; replace the keyboard

The 2011 Samsung scare, and why it still matters

The Samsung “keylogger” was a false alarm. On March 30, 2011, Network World ran a column by M. E. Kabay and security consultant Mohamed Hassan saying Hassan’s antivirus scanner, VIPRE, had found StarLogger in a C:\Windows\SL folder on two new Samsung laptops, an R525 and an R540. Gadget Daily News passed the claim on that day and told Samsung owners to look for the folder.

Within a day the story fell apart. Samsung explained that Microsoft’s Windows Live software created a C:\Windows\SL folder for its Slovenian language files. The Register reported on March 31 that antivirus testers made VIPRE flag “StarLogger” just by creating an empty folder called SL on a clean PC. GFI, VIPRE’s publisher, then confirmed it was a false positive.

The lesson for 2026 is practical. One scanner hit is a reason to look closer, not proof. Check what the file actually is, run a second scanner, and look for the behavior a keylogger needs, such as a startup entry or permission to read the keyboard. As Ars pointed out, the original claim came with a folder name and no logs, binaries or network traffic.

How to check a Windows laptop

Windows has the main tools built in. Work through them in this order.

1. Run a full scan, then an offline scan. Open Windows Security, go to Virus & threat protection, then Scan options. A full scan checks every file and program. The Microsoft Defender Antivirus (offline scan) option restarts the laptop and scans from the Windows Recovery Environment, without loading Windows. Microsoft says that makes it harder for persistent malware to hide or defend itself. Save your work first, then read the results under Protection history.

2. Check Allowed threats. On the same page, Allowed threats lists anything Defender flagged that someone chose to let run. If you didn’t allow it, select it and choose Don’t allow.

3. Review startup apps. A keylogger has to restart with the laptop. Go to Settings, Apps, Startup, or open Task Manager and pick the Startup apps tab. Task Manager also shows each app’s startup impact. Search the name of anything you don’t recognize before you disable it.

4. Look at installed apps and browser extensions. Monitoring tools often use bland names. Remove programs you didn’t install, and remove any browser extension you don’t use, since an extension can read what you type into web pages.

5. Make sure Tamper protection is on. It’s under Virus & threat protection settings. Microsoft describes it as stopping malicious apps from switching off settings like real-time protection.

How to check a Mac

On a Mac, the permission lists tell you most of what you need. macOS makes apps ask before they can watch your keyboard, so a keylogger usually has to appear in one of these places.

1. Input Monitoring. Choose Apple menu, System Settings, Privacy & Security, then Input Monitoring. Apple’s guide says some apps “can monitor your keyboard, mouse, or trackpad even when you’re using other apps.” Turn off anything you don’t recognize or no longer need.

2. Accessibility. In the same Privacy & Security section, open Accessibility. Apps listed here can control your Mac. Apple warns that granting this access also gives apps access to information like contacts and calendars, so only allow apps you know. Password managers, window tools and remote-support apps legitimately appear here.

3. Login Items & Extensions. Go to System Settings, General, Login Items & Extensions. Check both the Open at Login list and App Background Activity, which covers apps that run tasks when they aren’t open.

4. Screen Recording. It’s also under Privacy & Security. Some spyware takes screenshots as well as logging keys. StarLogger had a screen capture feature, per Ars Technica.

If something is listed that you never approved, note its name before you remove it. You may want that evidence later.

How to check for a hardware keylogger

Look, because software can’t help. Follow the cable from any external keyboard to the laptop. A small extra plug, an adapter you didn’t buy, or a USB stub between the cable and the port is the classic sign. Wikipedia notes they’re often disguised to blend in with normal cabling.

Check USB hubs and docks too, since those give a device somewhere to sit. If you’re on a shared or public computer you can’t inspect, avoid typing banking or work passwords on it at all.

A laptop’s built-in keyboard can’t take an inline logger without opening the case. If you think someone had the laptop alone for long enough to do that, treat it as compromised and get it checked by a repair shop you trust.

Signs that point to a keylogger

There’s no single symptom, so look for a pattern. The FTC’s stalkerware guidance, written for phones, lists signs that apply to laptops too: battery drain, unexpected data use, overheating, and devices turning on and off by themselves.

The stronger signal is what other people know. The FTC suggests asking whether someone knows details from private conversations, knows which sites you visit, or has had unsupervised access to your device. Account alerts help too. A login from a place you’ve never been, soon after you typed a new password, is worth taking seriously.

What to do if you find one

Change your passwords from a different, clean device first. If you change them on the infected laptop, the logger can record the new ones. Start with email, because email resets everything else.

Turn on multifactor authentication everywhere you can. CISA’s point is simple: with MFA, a stolen password alone isn’t enough for someone to get into the account. A keylogger can capture what you type, so app-based approval or a security key protects you better than a code you type in.

Then clean the laptop. Remove the program, run another offline scan, and if anything keeps coming back, back up your files and reinstall the operating system. Don’t restore apps from an old backup, which can bring the spyware back. The FTC gives the same advice for phones.

If you think a partner or ex installed it, think about safety before you remove anything. The FTC warns that removing stalkerware can tip off the person watching you. The National Domestic Violence Hotline (1-800-799-7233, or text START to 88788) can help you plan and keep evidence. Contact them from a device the other person hasn’t touched.

If it’s a work laptop, tell your IT team before you change anything. Monitoring software on company equipment may be there on purpose, and IT can tell you.

Old, unsupported software makes all of this easier for an attacker, which is why we’d remove leftovers like Adobe Flash and think twice about logging in to accounts on devices that no longer get updates, such as an iPad 2.

What to do next

Run a full scan, then an offline scan: Windows Security on a PC, or a reputable scanner on a Mac.
Open the Input Monitoring, Accessibility and Login Items lists on a Mac, or Startup apps on Windows, and remove anything you didn’t approve.
Follow every external keyboard cable to the port and remove any adapter you can’t explain.
If you find something, change your email password from a clean device and turn on multifactor authentication.
If a scanner flags one file and nothing else looks wrong, check the file name and run a second scanner before you panic. That’s what the 2011 Samsung story teaches.

How to check a laptop for a keylogger