Symantec finds fat cache of swiped gaming logins

Security researchers Symantec have unearthed a monster cache of 44 million stolen gaming account and website login credentials.

The haul, thought to have been harvested using Trojans with information stealing capabilities, took in data associated with a variety of online games and websites.

Hackers had set up a system so that the relevant login details were checked using a botnet of PCs compromised with the Loginck Trojan, a strain of malware distinct from those that steal passwords and login details in the first place.

The approach allowed cybercrooks to check whether accounts were valid or not before selling them via gaming websites. The approach allowed hackers to build up a 17GB stash of compromised accounts alongside extremely useful sales data such as gaming levels, all without breaking a sweat. Accounts that have reached higher levels of a game are worth far more than those of newbies.

By using a distributed system of thousands of PCs rather than a handful of machines, crooks effectively avoid hitting blacklisting problems that would result from multiple-login failures from the same machine.

Trojans that steal banking login credentials get the most press, but those targeted at online gamers are also a big problem, particularly in the far east, as Symantec's research illustrates. A detailed write-up of the find can be found in a blog post here. ®