There's a surprising amount of malware out there that still actually captures keyboard input and nothing else. It's easier and more reliable to implement, espec

There's a surprising amount of malware out there that still actually captures keyboard input and nothing else. It's easier and more reliable to implement, especially in a malware context, and is usually plenty enough to extract what the operator wants (usually usernames and passwords for online banking). When additional context is collected it's often in the form of window titles. A lot of tools now gather screenshots and even better on-click screenshots, which defeat this type of on-screen keyboard device and is the main reason it's fallen out of use. And yes, there is malware that collects unencrypted traffic, but that is _appreciably_ more complex to design and implement than simple keylogging. There's also malware which pulls credentials directly out of the web browser memory, although improved protections on cross-process memory access are making this much harder to do on real operating systems. Both of these are better methods, but they are harder and operating systems are intentionally implementing measure to defeat them. For mostly historic reasons straightforward keylogging remains easy and reliable on modern computers.