Digital Forensic Analysis of Keylogger Attack Evidence on Websites Using the NIST Method - Arizona Firdonsyah; Dimas Rizki Setyaji (Prisma Sains : Jurnal Pengkajian Ilmu dan Pembelajaran Matematika dan IPA IKIP Mataram, 2026)
WordPress commands 43.2% of global websites and has become a primary target for keylogger attacks, with vulnerability trends showing exponential growth from 1,543 in 2014 to 8,907 in 2025 according to WPScan Vulnerability Database. This research employs the National Institute of Standards and Technology (NIST) SP 800-86 method integrated with MITRE ATT&CK framework to analyze WordPress websites suspected of keylogger infection. A comparative approach is implemented by comparing WordPress against the DIABEX website (an AI-based diabetes diagnosis system) as baseline control. The research utilizes qualitative descriptive methodology through four NIST phases: Collection, Examination, Analysis, and Reporting, with historical activity log extraction from a 30-day period using Python-based forensic tools. Results identified a database-injected fileless keylogger on WordPress through wp_options table manipulation, with MITRE ATT&CK mapping across Initial Access (TA0001), Persistence (TA0003), Collection (T1056.001), and Exfiltration (TA0010) stages. Comparative security assessment revealed a 53-point gap between WordPress (29/100 - CRITICAL) and DIABEX (82/100 - GOOD), demonstrating that 97% of WordPress vulnerabilities originate from third-party plugins, requiring comprehensive database integrity monitoring and security audits.