Snake Keylogger: The Subscription Stealer That Logs Everything

Snake Keylogger is a long-running .NET-based commodity keylogger and credential stealer sold as a subscription on underground forums. Despite the name it is a full stealer: keystroke logging, saved-credential theft from browsers and email and FTP clients, clipboard capture, screenshots and host profiling, with exfiltration over SMTP, FTP, Telegram and HTTP. It spreads mainly through malicious-attachment phishing, and a February 2025 FortiGuard Labs report detailed a heavily active variant using AutoIt packaging and process hollowing into RegSvcs.exe. It is also tracked as 404 Keylogger and KrakenKeylogger.

Overview

Snake Keylogger is commodity crimeware sold as a subscription and used by many unrelated actors; there is no credible public attribution of its author. Its origin date is disputed — some reporting places its first forum release around August 2019, other sources around November 2020 — so it is best described as emerging around 2019 to 2020. It first entered Check Point’s Global Threat Index top ten in July 2021, ranked second that month after an intensive phishing push.

Technical Capabilities

• Keystroke logging via a low-level keyboard hook (SetWindowsHookEx with WH_KEYBOARD_LL). T1056.001
• Credential theft from installed browsers and from email and FTP clients. T1555.003
• Clipboard capture and periodic screenshots. T1115 T1113
• Host and location profiling to tag stolen data. T1082 T1614

It is modular: configuration specifies which exfiltration channels and target data to use.

The 2025 AutoIt Variant

FortiGuard Labs documented a prevalent February 2025 variant with a distinctive chain:

• AutoIt packaging: the payload is an AutoIt-compiled executable that unpacks and runs the keylogger, complicating static analysis and mimicking benign automation. T1027
• Persistence: an executable is dropped into a user-writable AppData subfolder and a VBS script into the Startup folder, which relaunches it at logon — no admin rights required. Specific file names vary between reports; take them from Fortinet’s original. T1547.001 T1059.005
• Injection: process hollowing into RegSvcs.exe, a trusted .NET utility — spawned suspended, its code replaced, then resumed. T1055.012

Exfiltration

Snake Keylogger exfiltrates over SMTP (email), FTP, the Telegram bot API and HTTP POST; older analyses also note Pastebin. Embedded Telegram bot tokens and SMTP credentials in the configuration are useful for detection, though values are per-sample. T1048.003 T1567

MITRE ATT&CK Mapping

Prevalence

Detection & Mitigation

• Alert on RegSvcs.exe or other .NET utilities being hollowed or making network connections — outbound SMTP, FTP or api.telegram.org traffic from such a process is highly anomalous.
• Flag an AutoIt-compiled executable spawning from a document or archive on a host with no legitimate AutoIt use, and VBS files written to the Startup folder.
• Apply attack-surface-reduction controls: block executable content from email and Office, block Office child processes, and monitor Startup-folder writes.
• Restrict workstation-originated SMTP and FTP egress, and block Telegram bot API where not needed.
• After infection, assume keystrokes and saved credentials were captured: rotate credentials and enforce MFA.