Advanced keylogger monitoring tool with Telegram bot integration

Introduction

System monitoring tools help us understand and improve cybersecurity. KeyMon_Pro is a keylogging tool I made for learning and research in safe environments. It includes keylogging, screen capture, clipboard monitoring, process tracking, and web browser history monitoring, all with secure data management and remote monitoring through Telegram.

In this blog, I'll show you how I built KeyMon_Pro, focusing on its structure, main features, challenges, and the ethical rules I followed.

Core Architecture

KeyMon_Pro is built with a modular design, which means it is easy to change, expand, and maintain. The system has three main parts:

1. Core Monitoring Services:

   • Keylogger for tracking keystrokes in real time. This is the main function of KeyMon_Pro.

   • Screenshot capture to keep track of what is on the screen.

   • Clipboard monitoring to see what gets copied or cut.

   • Process monitoring to watch system activity.

   • Browser activity tracking to see web usage.

2. Data Management:

   • JSON-based storage for efficient logging.

   • Secure data handling with encryption and access controls.

3. User Interface:

   • A setup GUI to make configuration easy.

   • Telegram bot integration for remote monitoring.

   • Real-time dashboards for interactive monitoring.

This setup makes sure that each part works by itself but also works well with the other parts.

Key Features Deep-Dive

This image shows the KeyMon_Pro configuration GUI, where users can set up monitoring features, define intervals, and configure the Telegram bot for remote monitoring.

KeyMon_pro

1. Advanced Input Monitoring

The Keylogger module is the main function of KeyMon_Pro. It is built using the pynput library to accurately track what keys are pressed.

Features:

• Word-level tracking

  : It detects when words are finished by watching for spaces, enters, and timeouts.

• Active window context

  : It logs which application was being used when keys were pressed.

• Multi-language keyboard support

  : It works with different keyboard layouts.

• Special key combination detection

  : It tracks shortcuts and system commands.

Snippet:

1class Keylogger:
2    def __init__(self, stop_event=None, buffer_size=100, word_timeout=2.0):
3        self.current_word = []  # Buffer for current word
4        self.key_buffer = deque(maxlen=buffer_size)  # Buffer for all keystrokes
5        self.word_complete_keys = {'space', 'enter'}

2. Visual Context Capture

The Screenshot module takes pictures of the screen at regular intervals and supports multiple monitors.

Features:

• Custom intervals

  : Users can set how often screenshots are taken.

• Multi-monitor support

  : Captures all screens at the same time.

• Image compression

  : Reduces image size without losing much quality.

• OpenCV integration

  : Adds more options for image processing.

Snippet:

1class ScreenshotCapture:
2    def __init__(self, interval=5, stop_event=None, use_opencv=False):
3        self.interval = interval
4        self.use_opencv = use_opencv and USE_OPENCV

3. Clipboard Analysis Engine

The Clipboard monitor keeps track of changes in clipboard content, such as text, images, and files.

Features:

• Content change detection

  : Logs any updates to the clipboard.

• Source tracking

  : Links clipboard data to the app it came from.

• Content verification

  : Helps identify sensitive information.

Snippet:

1class ClipboardMonitor:
2    def log_clipboard_change(self, content):
3        central_logger.log_event("clipboard", {
4            "content": content,
5            "timestamp": datetime.now().isoformat()
6        })

4. Advanced Browser History Monitoring

One of KeyMon_Pro's most sophisticated features is its comprehensive browser history monitoring system. The BrowserMonitor class provides cross-browser support with intelligent history tracking:

1class BrowserMonitor:
2    def __init__(self, stop_event=None, interval=5):
3        self.stop_event = stop_event or threading.Event()
4        self.interval = interval
5        self.last_activity = datetime.now()
6        self.notification_timeout = 300
7        # ... initialization code ...

Key features of the browser monitoring system include:

Multi-Browser Support

The system supports all major browsers across different operating systems:

• Google Chrome (including Beta and Dev channels)

• Mozilla Firefox

• Microsoft Edge

• Brave Browser

• Opera

• Safari (on macOS)

• Chromium

5. Process Monitoring System

This module watches what is happening at the system level, showing information about running processes and how they interact.

Features:

• Active process list

  : Shows running processes in real time.

• Window focus tracking

  : Watches which app is currently being used.

• Browser activity tracking

  : Logs web browsing details.

• Process relationship mapping

  : Shows parent and child processes.

5. Telegram Integration

The Telegram bot allows remote monitoring through an interactive interface. Users can get logs, view screenshots, and receive activity summaries.

Features:

• Real-time notifications

  : Sends alerts instantly for monitored events.

• Interactive commands

  : Options like getting logs or viewing recent screenshots.

• Activity summaries

  : Sends periodic updates about system activities.

Snippet:

1class TelegramReporter:
2    def create_main_menu(self):
3        keyboard = [
4            [InlineKeyboardButton("📊 Get Logs", callback_data='get_logs'),
5             InlineKeyboardButton("📸 Last Screenshot", callback_data='last_screenshot')],
6            [InlineKeyboardButton("📈 Summary", callback_data='summary'),
7             InlineKeyboardButton("ℹ️ Status", callback_data='status')]
8        ]

Security Considerations

Data Protection

• Encrypted storage

  : Logs are stored securely using encryption.

• Secure transmission

  : Data sent to Telegram is encrypted.

• Access control

  : Users need to log in to access the data.

• Data retention policies

  : Old data is deleted regularly to reduce risks.

Ethical Usage

KeyMon_Pro is only for learning and research. It is designed to:

• Work only in controlled environments.

• Require clear user consent.

• Go through regular security checks to avoid misuse.

Technical Implementation

Building the Executables

KeyMon_Pro uses PyInstaller to make standalone programs for the monitoring service and configuration GUI:

# Build monitor service executable pyinstaller monitor.spec # Build configuration GUI executable pyinstaller config.spec

Configuration System

A user-friendly GUI allows:

• Telegram bot setup

  : Connect your bot token and chat ID.

• Feature toggles

  : Turn specific monitoring features on or off.

• Interval customization

  : Set how often data is captured.

Conclusion

KeyMon_Pro is a keylogging and system monitoring tool that shows advanced cybersecurity techniques. Its modular design and many features make it useful for researchers and enthusiasts who want to understand how systems behave.

Future Development

What’s next for KeyMon_Pro:

• Camera activity monitoring

  : Record webcam activity to enhance monitoring capabilities.

• Voice recording

  : Capture audio for more comprehensive system monitoring.

Reminder: Always use tools like KeyMon_Pro ethically and responsibly, following the law and organizational guidelines.