Myths on Key-Logging (Virtual Keyboards)
We've been dealing with phishing malware since 2003, and within the lifespan of phishing malware, the main method for collecting data is through what's dubbed "form-grabbing". This technique steals the submissions (POST) from the web client (IE or FireFox) when signing into a financial institution website.
Here is a powerpoint we put together focusing on why authentication systems such as Virtual Keyboards and Scramble Pads do not protect from almost all the phishing malware on the Internet today.
virtualkeyboards.pdf