Listen to this Post
The Silent War on Your Keyboard
In the digital underworld, stealth is power. While many cyber threats aim to stay “fileless” to avoid detection, others adopt lesser-known but equally dangerous camouflage techniques. One of the most cunning methods is the use of NTFS Alternate Data Streams (ADS) — a hidden capability of Windows systems that allows files to store extra information without raising red flags in common file explorers. This technique is now being exploited by keyloggers to record every keystroke and clipboard activity, all while staying nearly invisible to antivirus software. A new Python-based malware specimen has been discovered doing exactly this — and it’s a powerful reminder that the battleground in cybersecurity is often hidden in plain sight.
Malware Overview: Hidden in Plain Text
A New Threat Leveraging NTFS ADS
A newly identified Python keylogger has taken an old-school Windows feature and turned it into a stealthy weapon. Alternate Data Streams (ADS), a lesser-known capability of NTFS file systems, allow files to store extra data in hidden streams. Normally used for metadata like the “Mark of the Web,” ADS is now being used by threat actors to secretly stash stolen data.
Keystroke Logging and Clipboard Hijacking
The script sets up a hidden directory inside the Windows AppData path (Microsoft\Windows\Cache). Inside, it creates a seemingly harmless file, syscache.dat, and then attaches an alternate data stream (:logdata) to it. This stream quietly logs every keystroke captured on the machine. But that’s not all. The malware also monitors clipboard contents, scraping any copied text. That includes passwords, sensitive emails, or even cryptocurrency wallet keys.
Deep Hiding with Windows APIs
To further conceal its presence, the malware uses the SetFileAttributesW() API with the 0x02 flag, making the host file hidden in the filesystem. This isn’t high-end obfuscation, but it’s effective enough to bypass casual scrutiny.
Surprisingly Low Detection Rate
Despite its capabilities, this malware isn’t deeply obfuscated. Yet, its VirusTotal score is shockingly low — only 3 out of 64 scanners detect it. That makes it exceptionally dangerous for everyday users and even businesses that rely on traditional antivirus tools.
No Exfiltration Detected… Yet
Interestingly, this script does not have a built-in data exfiltration function. That strongly suggests it’s part of a multi-stage attack where another payload handles the transmission of stolen data. This modularity is increasingly common in modern malware.
Detection with PowerShell
To detect hidden ADS-based files, cybersecurity experts recommend running a PowerShell script that lists files with more than one stream. These scripts can expose streams like Zone.Identifier or custom streams such as logdata, allowing security teams to spot anomalies before data is exfiltrated.
What Undercode Say:
The Strategic Shift from Fileless to ADS
While fileless malware has long been the dominant stealth strategy, ADS brings back a legacy tactic with renewed relevance. By embedding logs into alternate streams rather than traditional files, attackers sidestep both antivirus scans and casual human inspection. It’s a smart move, especially as endpoint detection tools increasingly focus on behavior and not just static file analysis.
Why This Malware is Scarier Than You Think
The
Antivirus Blind Spots
With just 3/64 detections on VirusTotal, this is a wake-up call for the cybersecurity industry. Signature-based defenses continue to lag behind emerging techniques that repurpose old features like ADS in new ways. It’s clear that security strategies must evolve toward behavior-based monitoring and deeper file system audits.
A Perfect Fit for APT Campaigns
This type of malware fits perfectly in Advanced Persistent Threat (APT) arsenals. It’s stealthy, modular, and can work quietly over long periods. Since it leaves minimal footprints, it can be integrated into longer attack chains, from espionage to ransomware staging.
NTFS ADS: A Tool or a Trap?
ADS was never intended for malicious use. Originally, it supported features like tagging files with metadata. But its stealth properties make it ripe for abuse, especially on systems where IT teams aren’t actively scanning for hidden streams.
Multi-Stage Malware Is the Norm
The absence of exfiltration code is telling. This malware is likely designed for partnership with other scripts or droppers, allowing one component to collect data while another transmits it. This compartmentalization makes detection even harder.
Defensive PowerShell Is Underused
The PowerShell script to detect ADS is simple yet incredibly powerful. It’s one of the few native tools that can reveal hidden streams, but it’s vastly underused. Organizations need to routinely scan their systems with this method to detect anomalies that traditional tools miss.
Supply Chain Attacks and ADS
There’s rising concern that ADS could be used to inject hidden payloads into legitimate software during the supply chain process, making detection even harder. With ADS, malicious content can ride along with trusted files, completely undetected.
The Need for Endpoint Visibility
This attack highlights the urgent need for deep endpoint visibility and file system monitoring. Without tools that detect ADS and behavior anomalies, even small scripts like this can wreak havoc.
Next Evolution: ADS + Encryption
While this keylogger is relatively simple, the next generation might include encrypted data streams, time-based activation, or machine learning for behavior shaping. That would make detection nearly impossible without forensic-level monitoring.
🔍 Fact Checker Results:
✅ ADS is a legitimate NTFS feature commonly used for metadata
✅ The Python keylogger stores logs in an alternate data stream, hiding from standard file listings
✅ VirusTotal confirms extremely low detection for this malware sample (3/64)
📊 Prediction:
🔮 Expect a sharp rise in malware using ADS, especially in targeted attacks on enterprises and governmental infrastructure. As detection tools lag behind, these threats will likely remain invisible in many systems. Future variants could integrate real-time exfiltration, encrypted payloads, and AI-driven keystroke analysis, making them more lethal and even harder to trace.
References:
Reported By: isc.sans.edu
Extra Source Hub:
https://www.quora.com/topic/Technology
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
