Description
Ardamax is a commercial keylogger program that captures keystrokes, instant messenger chats, web browser activity, and desktop screenshots. It can run in a stealth mode protected by a password, stores the collected data in an encrypted log file viewable only through its own Log Viewer, and sends the logs out by email, local network transfer, or FTP upload. Because vendors sell the product openly, defenders should triage its detections against authorized monitoring.
Stats
- First seen
- May 2022
- Last seen
- September 2026
Alert name variants
| Alert Name |
|---|
| Application.Keylog.Ardamax.DMF |
| Application.Keylogger.Ardamax.3 |
| Application.Keylogger.Ardamax.Gen |
| Dropped:Application.Keylogger.Ardamax.Gen |
| Win32.Keylogger.Ardamax |