Evil Crow Keylogger V2 - USB Hardware Keylogger and Wi-Fi BadUSB

Evil Crow Keylogger V2 is the second generation of the Evil Crow hardware keylogger. It combines a physical USB keylogger and BadUSB functionality in a single enclosure, controlled through a web interface over Wi-Fi. Designed for penetration testers, security researchers and trainers, it supports USB security audits, live demonstrations and team exercises.

How it works

Connect the device between a keyboard and a computer: the USB-A socket accepts the keyboard, while the USB-A plug connects to the computer. The keylogger records keystrokes to a microSD card. The web interface provides access to logs, the BadUSB payload editor and all settings. V2 connects to an existing Wi-Fi network or a phone hotspot, so you do not need to switch to the device's own network.

What's new in V2

• New platform: ESP32-S3 replaces the ATmega32U4 and ESP32-PICO combination used in V1. The microSD slot is integrated into the USB connector.
• BadUSB and payload management: create, edit, upload, save and run payloads from the web interface. The editor checks syntax, suggests commands and supports autocompletion.
• OS detection and AutoExec Planning: assign a different payload to each detected operating system: Windows, Linux, macOS, Android, iOS and ChromeOS. OS detection is in beta.
• Keyboard layout and USB identifiers in the web interface: change the layout on the fly without compiling firmware, as required in V1. Custom USB identifiers, device names and the USB Keyboard Autoclone feature are also available.
• Wi-Fi client mode and remote access: V1 created its own access point. V2 connects to an existing network or hotspot and offers a backup Wi-Fi configuration and built-in Husarnet VPN integration (P2P), without port forwarding on the router.
• USB Network Implant: an optional USB CDC-NCM network interface provides IP access to the connected computer through the device's Wi-Fi connection, alongside HID keyboard functionality.
• Remote shell: ready-made remote command scenarios for Windows, Linux and macOS, including when the connected computer has no network connection of its own.
• SAPSAN TERMINAL AI assistant: generate and refine payloads using natural-language instructions directly in the web interface, with a free or premium SAPSAN account.
• Wi-Fi updates: update the firmware over HTTP without opening the enclosure or connecting cables.

Specifications

• Microcontroller: ESP32-S3 (2.4 GHz Wi-Fi)
• Connectors: USB-A plug (to the computer) and USB-A socket (for the keyboard)
• Storage: microSD slot integrated into the USB connector (card sold separately)
• Control: web interface over Wi-Fi (client mode, backup network, Husarnet VPN)
• Enclosure: black plastic

Applications

• Auditing USB port security and corporate HID device policies
• Demonstrating USB attacks and defences to management and IT teams
• Red team training and exercises with security teams
• Researching and testing your own security controls

NOTICE: Evil Crow Keylogger V2 is a professional tool intended exclusively for lawful security testing on your own equipment or with written permission from the system owner. Its use requires appropriate knowledge and authorisation. The manufacturer and distributor accept no liability for misuse of the device.

What's included

• Evil Crow Keylogger V2 in its enclosure
• Preinstalled software
• A microSD card is not included. We recommend the SAPSAN 32 GB U3 microSD card, tested with our hardware.

Technical support

As an official distributor, we provide:

• A device with preinstalled firmware
• Access to the manufacturer's documentation and repository
• Firmware updates over Wi-Fi

Evil Crow Keylogger V2 replaces the EvilCrow Hardware Keylogger WiFi (V1).