Evil creepy creature

The Have I Been Pwned data breach notification service now lets you check if your email and password are one of 441,000 accounts stolen in an information-stealing campaign using RedLine malware.

RedLine is currently the most widely used information-stealing malware, distributed through phishing campaigns with malicious attachmentsYouTube scams, and warez/crack sites.

Once installed, the RedLine malware will attempt to steal cookies, credentials, credit cards, and autocomplete information stored in browsers. It also steals credentials stored in VPN clients and FTP clients, steals cryptocurrency wallets, and can download additional software or execute commands on the infected system.

The stolen data is collected into an archive, called "logs," and uploaded to a remote server from where the attacker can later collect them.

Attackers use these logs to compromise other accounts or sell them on dark web criminal marketplaces for as little as $5 per log.

RedLine logs publicly exposed

Last weekend, security researcher Bob Diachenko found a server exposing over 6 million RedLine logs collected in August and September 2021. The threat actor likely used this server to store stolen data but failed to secure it properly.

Diachenko told BleepingComputer that while this data contains 6 million records, many had the same email address used for different services.

This week many LastPass received emails warning that their master passwords may be compromised as they were used to log in from an unusual location.

Diachenko found that numerous LastPass credentials were stolen and stored in the exposed RedLine logs and checked various emails for LastPass users who received the emails to see if they were listed.

Diachenko told us that the server is still accessible but no longer appears to be used by the threat actors as the number of logs has not increased.

To make it easier for others to check if a hacker stole their data in the exposed RedLine malware campaign, Diachenko shared the data with Troy Hunt, who added it to his Have I Been Pwned service.

The RedLine data contains 441,657 unique email addresses stolen by RedLine that can now be searched on Have I Been Pwned.

Have I Been Pwned detecting email in RedLine logs
Have I Been Pwned detecting email in RedLine logs

Unfortunately, if your email address is listed in the RedLine malware logs, it's not enough to just change the passwords associated with that email account.

As RedLine targets all of your data, you must change your password for all accounts used on the machine, including corporate VPN and email accounts, and other personal accounts.

Furthermore, as RedLine attempts to steal cryptocurrency wallets, you should immediately transfer the tokens to another wallet if you own any.

Finally, if your email is listed as part of the RedLine records, you should scan your computer using an antivirus software to detect and remove any installed malware.

Related Articles:

2easy now a significant dark web marketplace for stolen data

Malicious Excel XLL add-ins push RedLine password-stealing malware

RedLine malware shows why passwords shouldn't be saved in browsers

Anubis Android malware returns to target 394 financial apps

Malicious Android app steals Malaysian bank credentials, MFA codes