Can keylogger record the admin password on macOS

Question

I have two accounts on my Mac: a standard user account for everyday activities and an administrator account. When I need to do something that requires the admin rights like changing something in the System Preferences or executing a terminal command I just enter my admin credentials and don't switch the account.

I am curious, is it possible for a keylogger that was installed in the scope of my standard user (without admin privileges) to record the admin password when I need to type it with su and sudo commands in the terminal or in the System Preferences popup? And do much bigger harm to my system possessing the administrator password? Is my reasoning correct here? Or installing a keylogger without admin rights isn't possible in the first place. If such malware was indeed installed in the system, will I be able to see it in the Security & Privacy -> Input Monitoring/Accessibility?

Generally speaking, is it secure to always type your admin credentials when you are logged in as a standard user, compared to switching to the admin account completely every time? Thanks!

Answer 1

There are a lot of side questions in your first version of the post, but at a high level, keyloggers can capture pass phrases, if the software is clever. But it may be a chicken and egg situation since malware may not need admin if it’s already installed and persistent.

Cleverly designed malware will nab your credentials, exfiltrate them and then uninstall itself before you might catch it. The crude ones, you likely can catch with “their hands in the cookie jar” more easily.

Have a look at tools like ReiKey if you want to learn more how keylogging works on a technical level on macOS or be alerted when this could be happening.

• https://objective-see.com/products/reikey.html

Answer 2

If a keylogger program is installed in the user scope without being given extra permissions, it cannot log passwords entered in the system dialogs.

However, if the keylogger already has administrative permissions that include the specific capability for accessibility input monitoring - then it can.

And of course, if there is a weakness (bug) on macOS that the keylogger exploits to gain such permisssion, then it would also be possible for it to log such passwords. However in that case, it is likely the malware could get administrative permissions entirely without knowing your password.