Kaspersky Digital Footprint Intelligence has revealed a staggering increase in data-stealing malware infections, with nearly 10 million devices falling victim last year alone. Drawing insights from infostealer malware log files traded on underground markets, Kaspersky warns that cyber-criminals are pilfering an average of 50.9 login credentials per infected device, posing a significant threat to both consumers and businesses.

The .com domain leads in compromised accounts, followed closely by domain zones associated with Brazil (.br), India (.in), Colombia (.co), and Vietnam (.vn). In the United Kingdom (.uk) domain, compromised accounts reached 2,500,000 in 2023, underscoring the global reach of this cyber threat.

To address this growing threat, Kaspersky has launched a dedicated landing page to raise awareness and provide strategies for mitigating risks associated with data-stealing malware.

According to Kaspersky Digital Footprint Intelligence data, about 10,000,000 personal and corporate devices were compromised with data-stealing malware in 2023, representing a staggering 643% increase over the past three years. 

While the number of infections experienced a marginal decline of 9% compared to 2022, cyber-criminal demand for logins and passwords remains high. Kaspersky warns that the actual number of infections could be even higher, with projected infections for 2023 reaching roughly 16,000,000.

“The dark-web value of log files with login credentials varies depending on the data’s appeal and the way it’s sold there. Credentials may be sold through a subscription service with regular uploads, a so-called “aggregator” for specific requests, or via a “shop” selling recently acquired login credentials exclusively to selected buyers,” said Sergey Shcherbel, an expert at Kaspersky Digital Footprint Intelligence.

Recommended reading

• Is Google Promoting Malware in Search?
• 100,000 Hacker Credentials Exposed From Info-stealer Malware
• Check Point Research | What’s Currently the Top Mobile Malware?

“Prices typically begin at $10 per log file in these shops. This highlights how crucial it is both for individuals and companies – especially those handling large online user communities – to stay alert. Leaked credentials carry a major threat, enabling cyber-criminals to execute various attacks such as unauthorised access for theft, social engineering, or impersonation.”

Individuals are advised to use comprehensive security solutions for all devices to prevent infections and detect suspicious activities. Moreover, companies can play a crucial role in protecting their users, employees, and partners by proactively monitoring leaks and prompting users to change compromised passwords immediately.