a few questions I'm wondering about, if anyone can help:<p>- how do those PW stealers work? are they similar to the Steam one, where it'd delete existing creds and then sniff newly entered ones?<p>- can this thing detect certain apps like FileZilla and then say "user entered <FTP site creds>" and send individual fields, and is that what is meant by supporting say FTP and FileZilla?<p>- what does PHP support mean? maybe looks for common stuff like php.ini, various other conf files like FPM, and tries to find DB/cache connection creds?<p>there's one other thing I'm wondering about, which is the light/easily crackable encryption of the keylogger's internals, and I vaguely remember reading about Google's encryption on the new recaptcha and people talking about all this stuff like complicated encryption routines baked into the client side JS that I really didn't understand except at a handwavy level, and wonder if that's the kind of thing some, say, intelligence/espionage outfit could use.<p>very interesting/engaging (fun) article, all in all, for me. and I appreciated the understatement of the (well-deserved) plug at the end.