Malware or a tool that records keystrokes on a compromised machine, often to steal credentials. In an OT setting, a keylogger could be used on an engineering workstation or HMI PC to capture operator logins or even capture the sequence of actions taken. This is one way attackers in the past have stolen operator credentials to pivot and issue rogue commands on control systems. Keyloggers can be hardware devices or software, and are notoriously sneaky.
