A technician discovers user input has been captured by a malicious actor. Which of the following malware types is MOST likely being used?

Cryptominers secretly use a computer's resources to mine cryptocurrency, which does not involve capturing user input.

A rootkit is a collection of tools designed to obtain root-level access and hide its presence, but its primary function is not directly capturing user input.

Spear phishing is a social engineering attack that attempts to trick specific individuals into revealing sensitive information, not a type of malware that captures input once inside the system.

A keylogger is a type of surveillance software that records every keystroke a user makes on their computer, including passwords, credit card numbers, and other sensitive information, making it the most likely cause for captured user input.