TINKYWINKEY

A Windows keylogger first publicly observed in 2025. It establishes service-based persistence and uses process injection to capture keystrokes and related user activity; it is a malware family rather than an attributed actor.