Eletiofe A Mystery Malware Stole 26 Million Passwords From Windows...

A Mystery Malware Stole 26 Million Passwords From Windows PCs

-

- Advertisment -

Researchers have discovered yet another massive trove of sensitive data, a dizzying 1.2 TB database containing login credentials, browser cookies, autofill data, and payment information extracted by malware that has yet to be identified.

In all, researchers from NordLocker said on Wednesday, the database contained 26 million login credentials, 1.1 million unique email addresses, more than 2 billion browser cookies, and 6.6 million files. In some cases, victims stored passwords in text files created with the Notepad application.

The stash also included over 1 million images and more than 650,000 Word and PDF files. Additionally, the malware made a screenshot after it infected the computer and took a picture using the device’s webcam. Stolen data also came from apps for messaging, email, gaming, and file-sharing. The data was extracted between 2018 and 2020 from more than 3 million PCs.

The discovery comes amid an epidemic of security breaches involving ransomware and other types of malware hitting large companies. In some cases, including the May ransomware attack on Colonial Pipeline, hackers first gained access using compromised accounts. Many such credentials are available for sale online.

Alon Gal, cofounder and CTO of security firm Hudson Rock, said that such data is often first collected by stealer malware installed by an attacker attempting to steal cryptocurrency or commit a similar type of crime.

The attacker “will likely then try to steal cryptocurrencies, and once he is done with the information, he will sell to groups whose expertise is ransomware, data breaches, and corporate espionage,” Gal told me. “These stealers are capturing browser passwords, cookies, files, and much more and sending it to the [command and control server] of the attacker.”

NordLocker researchers said there’s no shortage of sources for attackers to secure such information.

“The truth is, anyone can get their hands on custom malware,” the researchers wrote. “It’s cheap, customizable, and can be found all over the web. Dark web ads for these viruses uncover even more truth about this market. For instance, anyone can get their own custom malware and even lessons on how to use the stolen data for as little as $100. And custom does mean custom—advertisers promise that they can build a virus to attack virtually any app the buyer needs.”

NordLocker hasn’t been able to identify the malware used in this case. Gal said that from 2018 to 2019, widely used malware included Azorult and, more recently, an info stealer known as Raccoon. Once infected, a PC will regularly send pilfered data to a command and control server operated by the attacker.

In all, the malware collected account credentials for almost 1 million sites, including Facebook, Twitter, Amazon, and Gmail. Of the 2 billion cookies extracted, 22 percent remained valid at the time of the discovery. The files can be useful in piecing together the habits and interests of the victims, and if the cookies are used for authentication, they give access to the person’s online accounts. NordLocker provides other figures here.

People who want to determine if their data was swept up by the malware can check the Have I Been Pwned breach notification service, which has just uploaded a list of compromised accounts.

This story originally appeared on Ars Technica.


More Great WIRED Stories

Latest news

Google Deletes Adamu Garba’s “App” From PlayStore

Adamu Garba Following hundreds of unfavourable reviews, Google has axed Adamu Garba’s app from...

Married Man, Lady Die During Romp In Lagos

File photo Tragedy struck at a hotel over the weekend after a married man...

Police Rescue 26 Abducted Children In Ebonyi

The Ebonyi State Police Command on Monday disclosed that it rescued over twenty-six abducted children which were taken to...

“I Support Yahaya Bello, No Better Youth To Lead Nigeria Than Him” – Mikel Obi

Nigerian professional footballer who plays as a defensive midfielder for EFL Championship club Stoke City, John Mikel Obi, has...
- Advertisement -

Tragedy As Petrol Station Manager Is Found Dead Inside Underground Tank (Photo)

Ikroje Family members of a dead petrol station manager have cried out for justice...

Buhari’s Cow Routes Gazette Doesn’t Exist, Grazing Ban Stays – States Tell FG

Herdsmen At least five states have brushed aside President Muhammadu Buhari's assertion that there...

Must read

Google Deletes Adamu Garba’s “App” From PlayStore

Adamu Garba Following hundreds...

Married Man, Lady Die During Romp In Lagos

File photo Tragedy struck...
- Advertisement -

You might also likeRELATED
Recommended to you