TinkyWinkey: A Stealthy New Keylogger Is Hunting for Credentials on Windows

TinkyWinkey is a stealthy Windows-based keylogger that researchers at CYFIRMA have analysed, first detected on 24–25 June 2025. According to CYFIRMA, the malware comprises two main modules: Tinky Service, a Windows service that manages persistence across reboots, and Winkey Keylogger, which can run as an executable or via DLL injection into trusted processes.

The malware operates stealthily as both a service and an executable, capturing extensive system data such as OS version, CPU specifications, memory, and network details, while monitoring active windows and keyboard layouts. It uses DLL injection into explorer.exe for persistence and writes captured keystrokes and system details to a UTF-8 log file named logs_tw.txt in the system’s temporary directory.

A WinEventHook on EVENT_SYSTEM_FOREGROUND detects when the user switches applications to enhance the value of stolen credentials. The report also notes low‑level keyboard hooks and low‑level API calls, including RtlGetVersion for OS fingerprints and various Windows API calls to reconstruct the full CPU brand name.