Modern shadow keyloggers often go beyond simple keystrokes. They may include modules for "form grabbing" (capturing data entered into web forms before it is encrypted by SSL/TLS) and clipboard monitoring. This allows the attacker to capture data even if the user utilizes copy-paste functions to avoid typing passwords.
Shadow keyloggers are not for casual cybercriminals stealing Netflix accounts. They are tools for , corporate espionage, and nation-state actors.