26 million devices are infected by malware that steals bank card data including passwords
In this article (5)
25 million device users were targeted by a certain type of malware attack in 2023 and 2024. Infostealer malware does exactly what its name would suggest it does and grabs important information such as bank card numbers, passwords, and other sensitive data. Cyber security firm Kaspersky estimates that 2.3 million bank cards were leaked on the dark web in 2023-2024. The company says that every 14th infostealer infection ends up with the attacker scoring stolen bank card data.
Including the 9 million devices infected by infostealers in 2024 alone, a total of 26 million have been, in the words of Kaspersky, “compromised” by such malware. While only 1% of bank cards issued globally have been leaked on the dark web, 95% of the card numbers spotted are “technically valid” according to the report. But there’s more to this type of malware that goes beyond stealing bank card account numbers.
Kaspersky’s report goes on to state that this malware also steals credentials which is information used to verify a user’s identity. And that includes passwords. This data, along with cookies, are distributed to the dark web community. Victims can get into trouble without realizing that they are about to infect their phone, tablet, or computer. An infostealer is often disguised as legitimate software. Kaspersky’s report uses a game cheat as an example. The victim typically downloads the software and runs a malicious file.
The malware is then spread to other devices via phishing links, malicious email attachments, infected websites, and other methods. Last year, Redline was the most widespread infostealer as it accounted for 34% of infections. The fastest growing of the infostealers was Risepro whose share of infections rose from 14% in 2023 to 23% last year. Another rapidly growing infostealer is Stealc which debuted in 2023 with a 3% share of infections. That number grew to 13% in 2024.
Kaspersky says that if you do find yourself the victim of an infostealer, monitor your bank accounts and notifications. Have your bank card reissued and change the passwords for your bank app and website. Enable two-factor authorization and set spending limits if your bank allows you to do so. Be on the lookout for phishing attacks, fake texts, and bogus phone calls. If you’re not sure if a notification, email, or text is legit, call your bank. Kaspersky also suggests running security scans on your devices making sure to remove any detected malware.
Questions & Answers
Q.What kind of data does infostealer malware typically steal?
What kind of data does infostealer malware typically steal?
Infostealer malware grabs important information like bank card numbers, passwords, and other sensitive data. It also steals credentials used to verify a user’s identity and cookies.
Q.How do devices usually become infected by infostealer malware?
How do devices usually become infected by infostealer malware?
Devices typically become infected when a victim downloads what appears to be legitimate software and runs a malicious file. It can then spread via phishing links, malicious email attachments, or infected websites.
Q.What actions should victims take if they suspect an infostealer infection?
What actions should victims take if they suspect an infostealer infection?
Victims should monitor bank accounts, have their bank card reissued, and change bank app and website passwords. They should also enable two-factor authorisation, set spending limits, and run security scans.
Q.Which infostealer malware was the most widespread last year, and which saw the fastest growth?
Which infostealer malware was the most widespread last year, and which saw the fastest growth?
Redline was the most widespread infostealer last year, accounting for 34% of infections. Risepro was the fastest growing, with its share of infections rising from 14% to 23%.
Reader pulse
What is the biggest threat from infostealers?
16,150 votes so far