Spy Eye Botnet’s Bogus Billing Feature
Summary: The SpyEye botnet kit includes a module called "billinghammer" that automates purchases of worthless or copycat software using credit card data stolen from infected machines, with the botmaster listing renamed freeware on platforms including ClickBank, FastSpring, eSellerate, SetSystems, and Shareit. The module opens an Internet Explorer window and auto-fills cardholder data at user-defined intervals, routing each transaction through an infected system whose IP address approximates the cardholder's street address to evade anti-fraud controls.
What you should know: FastSpring's chief customer service officer Ken White told KrebsOnSecurity the company had not yet been successfully exploited, while Digital River, which operates all the other sales platforms coded into the kit, did not respond to repeated requests for comment - leaving the fraud exposure of the remaining stores unaddressed.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026