⚠ Time To Change All Your Passwords, Add 2FA etc.. ⚠
Suspected InfoStealer Malware Data Breach Exposed 184 Million Logins and Passwords
Massive data breach alert: 184 million passwords leaked; Apple, Google, Instagram, Microsoft logins exposed... The database was unencrypted without any password protection
Cybersecurity Researcher, Jeremiah Fowler, discovered and reported to Website Planet about a non-password-protected database that contained 184 million login and password credentials.
The publicly exposed database was not password-protected or encrypted. It contained 184,162,718 unique logins and passwords, totaling a massive 47.42 GB of raw credential data. In a limited sampling of the exposed documents, I saw thousands of files that included emails, usernames, passwords, and the URL links to the login or authorization for the accounts.
The database contained login and password credentials for a wide range of services, applications, and accounts, including email providers, Microsoft products, Facebook, Instagram, Snapchat, Roblox, and many more. I also saw credentials for bank and financial accounts, health platforms, and government portals from numerous countries that could put exposed individuals at significant risk.
The IP address indicated that the database was connected to two domain names. One domain is parked and not available while the other appears to be unregistered and available to purchase. The Whois registration is private, and there seemed to be no verifiable method to identify the real owner of the database containing potentially illegal data. So, I immediately sent a responsible disclosure notice to the hosting provider, and the database was restricted from public access soon after.
The hosting provider would not disclose their customer’s information, so it is not known if the database was used for criminal activity or if this information was gathered for legitimate research purposes and subsequently exposed due to oversight. It is also not known how long the database was exposed before I discovered it or if anyone else may have gained access to it.
The records exhibit multiple signs that the exposed data was harvested by some type of infostealer malware. Infostealer is a type of malicious software designed specifically to harvest sensitive information from an infected system. This malware usually targets credentials (like usernames and passwords) stored in web browsers, email clients, and messaging apps. Some variants of the malware can also steal autofill data, cookies, and crypto wallet information — some can even capture screenshots or log keystrokes.
It is not known exactly how this specific data was collected, but cybercriminals use a range of methods to deploy infostealers. For instance, they often conceal malware within phishing emails, malicious websites, or cracked software. Once the infostealer is active, the stolen data is often either circulated on dark web marketplaces and Telegram channels or used directly to commit fraud, attempt identity theft, or launch further cyber-attacks.
Read on...
https://www.websiteplanet.com/news/infostealer-breach-report/