HawkEye

HawkEye, also known as PredatorPain, is a long-running Windows credential-stealing malware family that originated as a commercial keylogger and evolved into a broader infostealer and downloader used by many unrelated threat actors. It has been sold since at least the late 2000s on criminal forums and dedicated sales sites, with cracked builds later expanding its adoption. HawkEye has been used in phishing, business email compromise, spam, and opportunistic credential-theft operations across multiple sectors worldwide, and it has also appeared in COVID-19-themed lures.

HawkEye is commonly delivered through spearphishing attachments, including malicious documents and compressed archives, as well as through trojanized software and other malware loaders. Many samples are implemented in .NET and use obfuscation and embedded resources to conceal additional components. Typical execution chains involve extracting an injector and payload from resources, copying itself into user-accessible directories, establishing persistence through Run keys and in some cases scheduled tasks, and deleting intermediate artifacts to reduce forensic visibility.

Functionally, HawkEye combines keylogging with broad credential theft. It can steal credentials and other sensitive data from web browsers, email clients, FTP applications, and additional software, and has been associated with theft of clipboard contents, form data, screenshots, system information, and cryptocurrency wallet data. It has also been observed detecting security tools, staging stolen data locally, and exfiltrating information over common application-layer protocols. Some variants perform process hollowing or related injection activity, including launching the payload inside another process. Builder-configurable modules and long-term development have produced substantial variation between samples while preserving the family’s core information-stealing behavior.