[GH-ISSUE #2406] MeshAgent.exe set a hook of type WH_KEYBOARD_LL to monitor user keystrokes #3421

New issue

Closed

opened 2026-03-14 07:18:40 +03:00 by kerem · 1 comment

kerem commented

2026-03-14 07:18:40 +03:00

Owner

Originally created by @Anaphylaxis on GitHub (Feb 6, 2026).
Original GitHub issue: https://github.com/amidaware/tacticalrmm/issues/2406

since 2.10.0 updated on 1 windows node with Windows Defender, got a wacatac notice (never previously seen before) that I ignored, but now getting notices that WH_KEYBOARD_LL is being used to keylog... why?

Originally created by @Anaphylaxis on GitHub (Feb 6, 2026). Original GitHub issue: https://github.com/amidaware/tacticalrmm/issues/2406 since 2.10.0 updated on 1 windows node with Windows Defender, got a wacatac notice (never previously seen before) that I ignored, but now getting notices that WH_KEYBOARD_LL is being used to keylog... why?

kerem closed this issue

2026-03-14 07:18:45 +03:00

kerem commented

2026-03-14 07:18:51 +03:00

Author

Owner

@Anaphylaxis commented on GitHub (Feb 6, 2026):

"the hook exists specifically to keep the remote viewer’s lock‑key indicator in sync"

@Anaphylaxis commented on GitHub (Feb 6, 2026): "the hook exists specifically to keep the remote viewer’s lock‑key indicator in sync"