Before an ACH batch leaves finance, malware on a clerk PC quietly records every keystroke. Which malware class best describes this behavior?
Select an answer to reveal the explanation.
Short Explanation
If something is typing along with the clerk, you are looking at a keylogger. It steals what gets typed—passwords, ACH details—rather than encrypting files or spreading itself across the floor.
Full Explanation
Keylogger spyware is malware that records keyboard input to steal credentials or sensitive data such as payment details. Quietly capturing every keystroke on a finance clerk PC before an ACH batch leaves is the textbook confidentiality theft pattern: authentication secrets, account numbers, and approval workflows become attacker-readable without necessarily encrypting files or spreading widely. For municipal treasury operations, that indicator should drive immediate credential resets and payment-hold procedures.
Ransomware that encrypts the batch file and demands cryptocurrency would present encryption and extortion, not silent keystroke capture. A worm that scans neighboring subnets for open SMB shares is a propagation and scanning behavior, unrelated to recording typed ACH data. A logic bomb that deletes ledgers only after a timed trigger is delayed sabotage of integrity/availability, not continuous input theft.
Exam caveat: spyware and keyloggers are often nested under broader Trojan delivery, but when the stem highlights recording keystrokes for credential or payment theft, choose the keylogger/spyware class rather than ransomware, worm, or logic bomb. Match the data-theft mechanism, not a generic “malware” label.
Operational check: isolate the clerk workstation, preserve memory and disk for forensic imaging if policy requires, force password and MFA resets for finance staff, review ACH batches prepared on that host, enable hardened input protections where available, and hunt for related remote-access tooling on the finance VLAN.