New TinkyWinkey: Stealthy Keylogger for Advanced Windows System Attacks
A sophisticated Windows-based keylogger known as TinkyWinkey emerged on underground forums in late June 2025, targeting both enterprise and individual endpoints with remarkable stealth. Unlike traditional keylogging tools that depend on simple hooks or user-mode processes, TinkyWinkey employs a dual-component architecture consisting of a Windows service and an injected DLL payload. This design allows it to remain hidden while harvesting rich contextual data, highlighting a concerning evolution in threat actor tactics. By blending deep system profiling with low-level keyboard capture, TinkyWinkey presents a highly attractive target for espionage and credential theft. The attack vector typically initiates with the installation of a malicious service named “Tinky,” which is configured for automatic startup through SCM API calls, ensuring persistence even after system reboots.
Upon activation, the service worker thread spawns the primary keylogging module (winkey.exe) within the active user session by invoking CreateProcessAsUser on a duplicated user token. This method not only avoids visible console windows but also grants direct access to user-mode desktop contexts. Analysts from Cyfirma noted that this technique enables the malware to operate seamlessly under standard user privileges while maintaining stealth within system processes. Once loaded, the keylogger component utilises low-level hooks (WH_KEYBOARD_LL) to intercept every keystroke, including media keys, modifier combinations, and Unicode characters. The malware maintains a continuous message loop to dispatch captured events, correlating each keystroke with the foreground window title and the current keyboard layout. Cyfirma researchers identified that TinkyWinkey dynamically detects layout changes through HKL handles, logging events whenever the victim switches between languages, ensuring that attackers can accurately reconstruct multilingual inputs, a feature often overlooked by simpler keyloggers.
Categories: Malware Analysis, Keylogging Techniques, Infection Mechanisms
Tags: TinkyWinkey, Keylogger, Windows, Malware, Stealth, DLL Injection, Persistence, Keystroke, Espionage, Credential Theft