Exploring the Market for Stolen Passwords
Summary: Krebs on Security describes an underground market where stolen credentials from botnet-infected PCs are sold for as little as $2 per account at retailers including Amazon, Walmart, Best Buy, Target and PayPal, with email-linked accounts fetching a dollar or two more. Bot kits like Citadel, ZeuS and SpyEye extract browser-stored passwords and capture credentials entered in web forms, and one Andromeda bot operator was selling access to 6 gigabytes of bot logs for a flat $150.
Bottom line: At $2 per working retail login, a few thousand infected machines turn into a bulk inventory of your customers' accounts, and accounts with credit cards or bank details attached command higher prices still.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026