The document provided by the U.S. Computer Emergency Readiness Team (CERT) gives an overview of spyware, provides examples of some common threats, and outlines policies and practices to defend against spyware and architect the value out of the spyware market.

According to the CERT document, spyware is defined as a class of malware that collects information from a computing system without the data owner's consent.  This data often includes keystrokes, screenshots, authentication credentials, personal email addresses, web form field data, internet usage habits, and other personal information,.  Often, the data is delivered to online attackers who sell it to others or use it themselves to execute financial crimes, identify theft, or use it for marketing or spam.

Download the CERT document