Adversaries may log user keystrokes to intercept credentials as the user types them.

Tactics
TA0006 TA0009

Sub-technique of
T1056


See: MITRE ATT&CK