The number of users affected by malware designed for identity theft has increased 600% so far this year with respect to the same period in 2008. Most of these are Trojans, but there are also many examples of phishing, worms and spyware.
"There's been major growth in the selling of personal information on the black market – such as credit card numbers and Paypal or Ebay accounts," says Jeremy Matthews, head of Panda's sub-Saharan operations. "We've also seen an increase of the distribution and infection of this identity-theft malware through social networks."
Panda's anti-malware laboratory receives nearly 37 000 samples of new viruses, worms, Trojans and other types of Internet threats every day. Between January and July 2009 Panda received 11-million new threats, 8-million – 71% – of which were Trojans, compared to 51% during the same period in 2007. Trojans are mostly aimed at stealing bank details or credit card numbers as well as passwords for other commercial services.
Hackers have also been busy exploring new channels for propagating threats as well as new sources of revenue. In the past malware samples mainly targeted users' online banking information by getting them to enter their user name and password in a spoof bank website. Now, however, potential victims are taken to any platform or online site in which their bank details may be stored or where they might have to enter them.
This resulted, says Matthews, in an increase in targeted attacks on pay platforms like Paypal and other services where users often save their payment details.
"These include popular online stores, such as Amazon, online auctions like eBay or even NGO portals where they make charitable donations," he says.
Similarly, whereas e-mail was practically the only channel used in the past for contacting victims, many other methods are now being used:
* Message distribution across social networks with fake URLs, such as Twitter or Facebook;
* Cloning of Web pages to make them appear among the first results in searches by keywords in popular search engines;
* SMS messages to cell phones; and
* Infecting computers with spyware which displays alarming messages and takes users to fake web sites like fake antivirus programs.
Messages that use social engineering are often the final touch to lure users into taking the bait. Once they have obtained credit card or bank details, the cyber-crooks can either sell the details on black market for about 3 euros each or use them to make purchases (which victims will be unaware of until they receive their bank statement).
Panda estimates that around 3% of all users have been victims of this techniques. The problem with these types of threats, unlike traditional viruses of the past, is that they are designed to go undetected, and therefore users do not realize they have become victims until it is too late.