A recent investigation by Hudson Rock, an intelligence company, discovered 120,000 infected systems — many of which belonging to hackers themselves and containing credentials for cybercrime forums.

The revelation was found after examining over 100 cybercrime forums for credential and information leaks gleaned from info-stealer malware. 

When analysing the compromised data, Hudson Rock found that the security practices to enter hacking forums are generally stronger than those for government websites. More than 40% of the identified hacker credentials were made up of passwords of at least 10 characters, featuring a mix of four character types.

This information was sourced mostly from info-stealer logs, which is a malware notorious for searching computers for sensitive login data. Of the 120,000 compromised systems identified, approximately 100,000 of them belonged to hackers, likely amateur ones. 

The researchers found that the forum with the highest number of infected users is Nulled.to (57,103), followed by Cracked.io (19,062), and Hackforums.net (13,366).

Info-stealers target web browsers primarily due to the autofill and password storage functions, where most of the info was taken during these compromises. Hackers will typically infect computers by luring them through fake promotions or YouTube tutorials.

Recommended reading

• Billions of Stolen Credentials are Being Advertised on Dark Web Forums
• Who Hacks the Hackers? Dark Web Cybercrime Forums Taken Down
• A Fake Microsoft Teams Email Campaign is Targeting Staff

The study determined that a majority of the infections could be traced back to three popular info-stealers: RedLine, Raccoon, and Azorult.

Info-stealers are a dangerous tool in a cyber-criminal’s arsenal. The data allows them to impersonate legitimate users. An infected machine is able to retrieve emails, account usernames, autofill data, and system information like IP addresses. 

“Info-stealer infections as a cybercrime trend surged by an incredible 6000% since 2018, positioning them as the primary initial attack vector used by threat actors to infiltrate organisations and execute cyberattacks, including ransomware, data breaches, account overtakes, and corporate espionage,” read the report.