HawkEye

HawkEye, also known as Predator Pain or PredatorPain, is a long-running commercially sold credential-stealing malware family for Windows that is commonly categorized as a keylogger but has evolved into a broader infostealer and surveillance trojan. Active since at least the early 2010s, and with reporting that traces its sale and use back even earlier, HawkEye has been marketed on hacking forums and dedicated sales sites, including later variants such as HawkEye Reborn v9. Its broad availability, low cost, and builder-driven customization have made it popular with a wide range of financially motivated operators and opportunistic threat actors.

HawkEye’s core functionality centers on credential theft and user surveillance. Across documented variants, it captures keystrokes, steals clipboard contents, gathers system information, and extracts saved credentials from web browsers, email clients, FTP software, messaging applications, and other desktop applications. Some variants also capture screenshots, collect webcam images, and steal additional application data such as form data or cryptocurrency wallet-related information. Multiple analyses note use of embedded password-recovery utilities and modular components to harvest browser and email credentials.

The malware commonly uses multi-stage execution chains and process injection to evade detection and blend into legitimate activity. Observed variants have used process hollowing or injection into legitimate .NET utilities such as RegAsm.exe and vbc.exe, extracted payload components from resources, and employed obfuscation frameworks including ConfuserEx. Anti-analysis and defense-evasion features reported across samples include anti-debugging checks, security-tool interference, self-deletion, and abuse of Image File Execution Options to impair defensive software. Persistence has been established through Windows Run keys and, in some cases, scheduled tasks.

HawkEye has been distributed primarily through phishing and spearphishing campaigns, often using business-themed lures such as invoices, payment notices, shipping documents, quotations, travel confirmations, and other corporate correspondence. Document-based delivery has included malicious Office files exploiting CVE-2017-11882, as well as compressed archives containing executables. It has also been delivered through loaders, crypters, compromised hosting, and trojanized or fake software. COVID-19-themed spam campaigns also used HawkEye as a payload.

Exfiltration methods vary by build and operator configuration. Documented variants have sent stolen data via SMTP email, FTP, SFTP, HTTP POST, and PHP-based web panels, with some campaigns using periodic automated exfiltration. HawkEye has been used globally across many sectors, including industrial, engineering, manufacturing, transportation, education, government, healthcare-adjacent, and professional services environments. It has featured in financially motivated campaigns such as Operation Ghoul and has also appeared in broader commodity-malware ecosystems alongside loaders, crypters, and other stealers. Its longevity and adaptability have kept it relevant as a widely used credential theft platform.