Abstract: In an example embodiment described herein, keyboard monitoring logic is operable to obtain data typed into a keyboard. The data typed into the keyboard is compared with predefined protected data stored in a local credential file. If data typed into the keyboard matches predefined protected data stored in the credential file, the keyboard monitoring logic determines whether the destination of the typed data (e.g., the application, website, or both the application and website are stored in a whitelist. If the destination is not stored in the whitelist, the keyboard monitoring logic determines that an attempt of unauthorized access to protected data is occurring.