Published in News

Onliner spambot is huge

by on30 August 2017


Has control of 711 million email accounts

A Paris-based security researcher, who goes by the pseudonymous handle Benkow, has discovered an open and accessible web server hosted in the Netherlands, which stores dozens of text files containing a huge batch of email addresses, passwords, and email servers used to send spam.

 Those credentials are crucial for the spammer's large-scale malware operation to bypass spam filters by sending email through legitimate email servers.

The spambot, dubbed "Onliner", is used to deliver the Ursnif banking malware into inboxes all over the world. To date, it's resulted in more than 100,000 unique infections across the world, Benkow told ZDNet.

Troy Hunt, who runs breach notification site Have I Been Pwned, said it was a "mind-boggling amount of data". Hunt, who analyzed the data and details his findings in a blog post, called it the "largest" batch of data to enter the breach notification site in its history... Those credentials, he explained, have been scraped and collated from other data breaches, such as the LinkedIn hack and the Badoo hack, as well also other unknown sources.

The data includes information on 80 million email servers, and it's all used to identify which recipients have Windows computers, so they can be targeted in follow-up emails delivering Windows-specific malware.

Last modified on 30 August 2017
Rate this item
(0 votes)

Read more about: