A security researcher has uncovered one of the largest spam lists ever. It contains a total of 711 million email accounts and was amassed by the “Onliner” spambot, which has been used before to spread malware around the world.
The list does not only contain email addresses, but also passwords and emails from servers that the spambot uses to send their spam campaigns. Of those 711 million, 80 million are SMTP credentials from different servers that the spambots network can use to send emails that look legitimate.
“Onliner” has been responsible for over 100,000 infections by banking malware Ursnif in all parts of the world. Ursnif is a Trojan capable of stealing personal data such as login credentials, passwords, and credit card information.
The Onliner spam campaign uses a sophisticated method to send your emails. Thanks to all those SMTP credentials that you have, you are able to send an email that seems legitimate and that is not detected by the antispam filters of your email service.
With those 80 million server email accounts, Onliner sends its spam campaign to the other 630 million emails it has amassed on its list. These first emails serve to identify potential victims, seem harmless but contain an image of a pixel that identifies the user’s operating system and other information once the user opens it.
If the attacker detects Windows computers then he knows exactly which ones Ursnif malware can send and does not waste time or resources with other systems, besides that it does not make much noise and risks being detected by the authorities quickly.
The emails infected with malware arrive days later pretending to be receipts of parcels, hotels or insurance companies, but they contain a malicious JavaScript file.
Troy Hunt of Have I Been Pwned has added this public database to your site, so you can check if your data is part of the Onliner spam list.
About2ZF77
