Cybercriminals are selling bulk log-in credentials of social networking sites Facebook and Twitter, and web server management software cPanel.
Security company Trusteer says it has discovered evidence of “factory outlets” where the information are being put up for sale at wholesale rate using underworld advertisements. The information were also available in country-specific batches at $30 a log-in.
Login credentials of financial sites are more valuable to most cybercriminals. The information is harvested by infecting systems with Trojans such as Zeus or SpyEye. These malwares also captures the login credentials used on the victim’s machine to access other websites, in addition to online banking credentials.
“To monetize the login credentials that pile up, fraudsters have started setting up “Factory Outlets” to sell them off,” Amit Klein, Trusteer’s chief technical officer, wrote in a blog.
He stress that the offering of cPanel credentials was particularly worrisome.
Fraudsters can use the account logins for web hosting admin system like cPanel to hijack a website and “plant malicious codes on these sites … that can exploit browser vulnerabilities and infect machines through drive-by-downloads.” The next step, in common practice, would be to “lure victims to the site through phishing emails and social network messages,” infecting the victims machines to carry out attacks and start over the vicious cycle.
Having access to bulk social network accounts can also be used for spamming and spreading scams on the sites.
“This latest development provides a window into the vast cybercrime aftermarket that has risen up on the internet and been made possible by sophisticated malware. Whether it’s bulk drive-by download infections, bulk login credentials, pre-built web-injects, etc., criminals today have an unprecedented arsenal of tools at their disposal to attack banks and enterprises,” Amit wrote.
Facebook officials told Trusteer that it actively detects known malware on users’ devices and validates every login to the site to check for malicious activity.
{ 0 comments }
