Babar Spyware - Spotlight

[Chiefcrowe]

http://www.cyphort.com/babar-suspected-nation-state-spyware-spotlight

 

[postmortemIA]

tl;dr : Injects itself as DLL, can be loaded with any executable, thanks to generous Windows API can read all kinds of user input from other processes such as keystrokes..