New TinkyWinkey Silently Attacks Windows Systems

A sophisticated Windows keylogger known as TinkyWinkeybegan appearing on underground forums in late June 2025, targeting corporate and individual systems with unprecedented stealth. Unlike traditional keyloggers that rely on simple hooks or user-mode processes, TinkyWinkey uses two components – a Windows service and an embedded DLL payload – to remain hidden while collecting rich contextual data.

See also: Beware! New advanced variant of Snake Keylogger malware

The emergence of the malware highlights a worrying evolution in threat actors’ tactics, combining deep system profiling with low-level keystroke logging to provide a particularly attractive target for espionage and credential theft. The TinkyWinkey attack path typically begins with the installation of a malicious service called “Tinky.”

Installed via SCM API calls, the service is configured to start automatically, ensuring persistence even across system reboots. After activation, the service's worker thread creates the main keyboard capture model (winkey.exe) within the active user session by calling CreateProcessAsUser on a duplicate user token. This approach not only avoids visible console windows but also gains direct access to user-mode desktop environments.

Analysts noted that this technique allows the malware to operate seamlessly under standard user privileges while maintaining stealth within system processes. Once loaded, the keyboard logging component uses low-level hooks (WH_KEYBOARD_LL) to intercept every keystroke, including media keys, modifier combinations, and Unicode characters. TinkyWinkey maintains a continuous message loop to send the logged events, associating each keystroke with the title of the foreground window and the keyboard layout.

Researchers found that TinkyWinkey dynamically detects layout changes via HKL handlers, recording events whenever the victim switches languages. This ensures that attackers can accurately reconstruct multilingual inputs, a feature often overlooked by simpler keyloggers. Infection Mechanism and Persistence Tactics. TinkyWinkey's infection mechanism relies on persistence via service and stealth DLL injection.

See also: Nova Keylogger steals credentials and captures screenshots 

After installing the “Tinky” service, the loader resolves the PID of a trusted process – most commonly explorer.exe – using a custom FindTargetPID. Upon obtaining a handle with PROCESS_ALL_ACCESS, it allocates memory in the targeted process via VirtualAllocEx and writes the full path to keylogger.dll.

A subsequent CreateRemoteThread call, pointing to LoadLibraryW, forces the trusted process to load the malicious DLL. This remote injection method not only hides the keyboard logging code inside a legitimate process, but also evades many endpoint protection solutions that monitor standalone executables.

A final WaitForSingleObject ensures that the injection completes cleanly before the handles are closed, preserving system stability and further masking the breach from forensic analysis. Through the combination of service execution and precise DLL injection, TinkyWinkey achieves a level of stealth and resilience rarely seen in commercial malware, rendering traditional detection and removal strategies inadequate for defending modern Windows environments.

A keylogger (or keyboard recorder) is a type of software or hardware that records every keystroke pressed on a keyboard, usually without the user's knowledge. It is often used for malicious purposes, such as stealing passwords, personal data, or other sensitive information. However, it can also have legitimate applications, such as monitoring computer usage by parents or employers.

See also: VIPKeyLogger: Steals credentials via dangerous Office files

Keyloggers can be either software programs that run “silently” in the background of a computer, or physical devices that are placed between the keyboard and the computer. They can be difficult to detect, especially if they are well camouflaged. Using a keylogger without consent is illegal in most countries and is considered a form of cybercrime. For protection, it is recommended to use an up-to-date antivirus and regularly scan the system.