A new study has analysed statistical data gathered from 3,25-million Windows-based computers worldwide infected with a malicious Trojan.
The recently discovered database hosts 1,2Tb of stolen information, including billions of personal records like passwords, cookies, and files, that dates back to 2018-2020.
Around 22% of stolen cookies were valid on the day of the discovery, according to the study by NordLocker in partnership with third-party researchers.
“This Trojan is just the tip of the iceberg, as unaware users are exposed to thousands of types of malware every day. The latest statistics indicate that, in 2020, over 111-million malware infections affected devices running on the Windows operating system,” says Oliver Noble, a cybersecurity expert at NordLocker. “Our case study digs deeper into malware to illustrate how bad actors operate and what damage computer viruses can actually cause.”
To present the alarming findings, the researchers shared depersonalised data stolen by the malware with NordLocker analysts, who then categorised the most valuable information into four large types: credentials, cookies, files, and software data.
Credentials
The unnamed malware, which was transmitted via email attachments and illegal software, successfully stole around 26-million credentials from around 1-million different websites.
The most affected services were social media websites, such as Facebook (1,5-million stolen credentials), Twitter (261 773), and Instagram (153 754), email service providers, namely Google (1,5-million), Outlook (403 580), and Yahoo (224 961), and streaming websites like Netflix (170 067), Twitch (106 690), and Spotify (61 349).
“Stolen credentials, such as a username or an email accompanied by a password, can wreak havoc not only on your social media. Imagine hackers getting their hands on your private emails, financial services, and even online shopping accounts, which usually contain your credit card details,” warns Noble.
Cookies
Among the staggering amount of stolen data, NordLocker analysts found more than 2-billion cookies, 22% of which were valid on the day of the discovery.
The majority of stolen cookies come from online marketplaces like AliExpress (4,8-million stolen cookies), online gaming platforms like Steam (2-million), file hosting and sharing services like MediaFire (3,2-million), social media like Facebook (8-million), and video streaming services like YouTube (17,1-million).
Cookies are essential for some websites to operate, but they can also help hackers construct a pretty accurate picture of a website visitor, including their location, browsing history, habits, and interests. If a cookie gets hijacked, a cybercriminal might impersonate a victim and even gain unauthorized access to their online accounts.
“Even though hackers won’t be able to empty your bank account with the cookies stolen from your online banking session, they can learn your bank’s name and timestamps of your transactions. This information can be used in phishing scams where hackers might try to contact you pretending to be the bank’s representative and trick you into giving away your personally identifiable information,” Noble explains.
Files
The malware stole over 6,6-million files affected users had stored on their desktops and in the Downloads folder. Of those files, 50% are text files, while over 16% are image files like .png and .jpg, and around 10,5% of all stolen files are of .doc, .docx, and .pdf type.
“On average, the malware stole only two files from each computer. This indicates that users are getting smarter and more security-focused, which means they keep important information in the cloud or somewhere else to conceal it from prying eyes,” says the cybersecurity expert at NordLocker. “However, we also found that some people still store confidential documents, photocopies of passports, and even passwords written down in Notepad on their desktop, thus risking the exposure of their most sensitive data.”
Software data
The analyzed database also contains autofill data and payment information from 48 applications.
NordLocker’s study shows that the malware targeted apps, mostly web browsers, to steal the vast majority of data.
It also extracted data from messaging apps, email providers, as well as file-sharing and gaming clients. For example, the virus stole 19,4-million credentials (an email or username together with a password) from Google Chrome, 3,3-million credentials from Mozilla Firefox, and 2-million from Opera. There are also thousands of credentials stolen from big names like Torch, Brave, Vivadi, and Yandex.
“This piece of data should be very alarming to people who use the autofill feature in their browser. Although this functionality is very convenient and saves time, it comes with great security risks as it’s not malware-proof. Stolen credentials enable hackers to log in to your online accounts and access your personal information. And it might take you a while to notice suspicious activities that indicate your data was breached,” says Noble.