New TinkyWinkey Trojan Targets Windows Systems With Sophisticated Keylogging

A sophisticated new keylogger malware dubbed “TinkyWinkey” is targeting Windows systems with advanced stealth and data exfiltration features, first observed in late June 2025. It operates with a dual-component architecture: a Tinky Service that handles persistence and system integration, and the Winkey Keylogger that captures data, with the service registering as a legitimate Windows service to start automatically on boot.

The malware uses DLL injection to embed its payload into trusted processes, notably explorer.exe, enabling it to blend with legitimate activity and maintain operation via a dedicated message loop. TinkyWinkey’s data collection goes beyond keystrokes, gathering detailed hardware and software information and monitoring foreground window transitions to correlate keystrokes with specific applications.

On 24–25 June 2025 the Windows 10 keylogger variant was identified, suggesting a broader campaign and evolution of endpoint threats, according to GBHackers on Security.