Millions of Credentials Stolen Each Day by Stealer Malware

The article reports that the cybercrime ecosystem around stealer malware processes millions of stolen credentials daily through sophisticated distribution networks. It notes that Telegram emerged as the primary data driver within the stealer ecosystem, capable of contributing millions of unique credentials in a single day, with a single Telegram account processing as many as 50 million credentials in 24 hours at peak.

Researchers monitoring these platforms say the operation has evolved into highly organised criminal enterprises, and they built a data ingestion system to help victims, partnering with Have I Been Pwned to alert individuals whose credentials had been compromised. The monitoring infrastructure used Telegram’s MTProto wire format and deployed around 20 premium Telegram accounts as workers dedicated to monitoring and scraping channels, with data batch-inserted into ClickHouse databases for analysis.

Researchers ultimately donated their collected data to Have I Been Pwned rather than monetising it. According to Have I Been Pwned, this collaboration aimed to help victims secure accounts while avoiding misuse by platforms that lack safeguards.