This is why Windows used to ask for Ctrl-alt-del before login. And if you have malware already on your system, it's already too late.

Aside from already having malware making this irrelevant, if you didn't just physically attach a new keyboard, the message about a new keyboard is also going to seem very suspicious.