Global cybersecurity firm, Group-IB, has uncovered a surge in information-stealing malware distributed through Telegram channels. These groups, primarily Russian-speaking and operating under a “stealer-as-a-service” model, utilize tools like Racoon and RedLine to target login credentials for various online accounts. This includes gaming platforms, online retailers, banking information, payment records, and even cryptocurrency wallet details.

The impact of these attacks is significant. In the first half of 2022 alone, over 890,000 devices were compromised, resulting in the theft of a staggering 50 million passwords. Group-IB analysts link this rise in stealers to the evolution of the “Classiscam” scam scheme. They’ve observed a concerning trend where low-level online scammers are transitioning to this more dangerous method.

The stolen data is then used by the attackers for financial gain or sold on the cybercrime black market. Group-IB emphasizes the significant threat posed by stealers, citing a recent attack on Uber where stolen credentials, possibly obtained via a Racoon stealer, were used.

To trick users into downloading stealers, cybercriminals employ various deceptive tactics. These include embedding malicious links in YouTube video reviews of popular games, mining software or NFT files on specialized forums, direct messages with NFT artists, and social media posts promoting fake giveaways and lotteries.

The reach of these attacks is global. Millions of credentials and financial data have been stolen. Pakistan has also seen a rise in infected devices, with the number jumping from over 5,000 in 2021 to over 16,000 in the first half of 2022.

To stay safe from these threats, Group-IB advises users to avoid downloading software from untrusted sources. Additionally, using isolated virtual machines or alternative operating systems for risky installations is recommended. They also emphasize the importance of good password hygiene, including avoiding saving passwords in browsers and regularly clearing browser cookies. Finally, the report encourages organizations to take a proactive approach to cybersecurity by implementing modern digital risk protection solutions.