Millions of Credentials Stolen Each Day by Stealer Malware
The ecosystem of stealer malware has expanded significantly, with threat actors processing millions of stolen credentials daily through advanced distribution networks.
The ecosystem of stealer malware has expanded significantly, with threat actors processing millions of stolen credentials daily through advanced distribution networks.
Security researchers have monitored these operations, uncovering an infrastructure that processes victim data at large volumes via platforms such as Telegram, forums, and social media sites.
The stealer log ecosystem has evolved from scattered operations into organized criminal enterprises over recent years. Researchers have implemented a data ingestion system to help victims, partnering with Have I Been Pwned to alert individuals whose credentials have been compromised. This monitoring infrastructure aims to capture unique data and provide near real-time alerting capabilities.
Research has shown that Telegram is a primary data driver within the stealer ecosystem, contributing millions of unique credentials daily. At peak activity, a single Telegram account can process up to 50 million credentials in 24 hours, highlighting the industrial scale of credential theft operations.
The stealer log ecosystem operates with a hierarchical structure, encompassing distinct roles and responsibilities. Primary sellers manage key operations, maintaining both public channels for sample sharing and paid private channels for clients to access fresh stealer logs. These operators collaborate with traffers to distribute malware through various vectors, while aggregators collect and redistribute logs across multiple channels.
The stealer log ecosystem has evolved from scattered operations into organized criminal enterprises over recent years.
Aggregators often leak data publicly to gain attention and build reputation within criminal communities. They combine files from different sources, making tracking efforts more complex. Primary sellers frequently password-protect their archives to prevent aggregators from claiming credit, adding complexity to the data distribution process.
Researchers developed a monitoring infrastructure using Telegram's MTProto wire format, deploying approximately 20 premium Telegram accounts to monitor and scrape channels. These workers used message listeners to forward incoming messages to processors, extracting invite links, identifying attachments, and forwarding files to a downloading engine for processing.
The system included deduplication mechanisms to manage redundant data. Files were checked using Telegram's FileHash before downloading, with a second deduplication layer using ClickHouse's ReplacingMergeTree architecture. This approach enabled tracking of credential distribution across the criminal ecosystem, while managing storage constraints.
The processor inspected messages for stolen data indicators, instructing workers to join relevant channels automatically. Downloaded files were analyzed to determine their format before parsing and batch-inserted into ClickHouse databases. Successfully processed files were deleted immediately to conserve storage space.
The research team focused on adversary infrastructure by starting with known malicious Telegram channels and using them as seed data. Channels referenced by multiple malicious sources received higher malicious probability rankings and were prioritized for crawling. This approach allowed mapping of the interconnected network of credential theft operations while avoiding false positives.
Diversity in data formats posed challenges, as different malware families and traffers used varying output structures. The research team developed flexible parsing capabilities to extract credentials from a wide range of file formats encountered. Ultimately, the collected data was donated to Have I Been Pwned to assist victims in securing their accounts, rather than monetizing it.
Based on reporting by GBHackers.