[tony101]

And grab any U2F security keys in sight.

[oh_sigh]

A missing U2F key might trigger an audit which could lead to discovery of the keylogger. Better bet would be to get the passwords, and then come back and register a second U2F key to the victims account.