The Have I Been Pwned data breach notification service now lets you check if your email and password are one of 441,000 accounts stolen in an information-stealing campaign using RedLine malware.
RedLine is currently the most widely used information-stealing malware, distributed through phishing campaigns with malicious attachments, YouTube scams, and warez/crack sites.
Once installed, the RedLine malware will attempt to steal cookies, credentials, credit cards, and autocomplete information stored in browsers. It also steals credentials stored in VPN clients and FTP clients, steals cryptocurrency wallets, and can download additional software or execute commands on the infected system.
The stolen data is collected into an archive, called “logs,” and uploaded to a remote server from where the attacker can later collect them.
Attackers use these logs to compromise other accounts or sell them on dark web criminal marketplaces for as little as $5 per log.