Programs can detect Ctrl alt del somehow, because RDP clients do it. But they can't intercept it. But a phishing program can just show the enter password scree

Programs can detect Ctrl alt del somehow, because RDP clients do it. But they can't intercept it. But a phishing program can just show the enter password screen, without the ctrl alt del prompt. Few users understand the security need to press ctrl alt del. And in newer Windows, it doesn't seem to prompt unless you enable it via GP.