Keyloggers often use email, rather than C2 servers, to exfiltrate data. Cofense says a huge chunk of that is done using Zoho servers.

A series of devastating operational mistakes brought down a student hacker who sold thousands of copies of his keylogger on HackForums.