9.6 C
Casper
Sunday, May 26, 2024

Kaspersky: 36M+ AI and Gaming Credentials Compromized

Must read

Kaspersky Digital Footprint Intelligence experts discovered staggering amounts of stolen login credentials as they analyzed in light of the Mobile World Congress 2024.

Investigating the dark web market for credential theft from popular AI and gaming websites, the cybersecurity specialists found:

  • Over the past three years, 34,000,000 Roblox users’ credentials (logins and passwords) were compromised with malware and leaked on the dark web.
  • In 2023, ChatGPT users’ stolen credentials increased 33-fold compared to the previous year, as 664,000 records with logins and passwords were posted on the dark web.
  • Credentials were stolen using info stealers, specialized malware designed to steal user logins and passwords that infect personal and corporate devices through phishing and other methods. 

The sale of compromised login credentials occupies a significant part of the dark web market. Cybercriminals typically buy and sell accounts from various online platforms and services. These accounts are often initially stolen using data-stealing malware and then leaked on the dark web via infostealer log files, where they can be further monetized as valuable assets within cybercriminal activity. Kaspersky has researched the trends within this market and offers insights on how businesses and individuals can safeguard against the corresponding threats.

AI-services’ credential thefts are a steady trend

Credentials from various AI services – image editing, translation, text tuning, chatbots, and voice generators – are being compromised due to their growing popularity. Over the past three years, approximately 1,160,000 application users’ credentials (logins and passwords) from AI-powered online graphic design tool Canva were compromised with data-stealing malware. Kaspersky Digital Footprint Intelligence data showed these credentials surfaced on the dark web forums and shadowy Telegram channels. Another popular AI writing assistant, Grammarly, had around 839,000 user credentials stolen between 2021 and 2023.

One of the most popular AI companies, OpenAI, also witnessed users’ credentials being leaked due to info stealer activities – nearly 688,000 ChatGPT credentials were compromised between 2021 and 2023 and found on shadowy channels. Notably, in the last year of widespread chatbot adoption, the number of logins and passwords leaked surged by nearly 33 times in 2023 compared to the previous year, reaching approximately 664,000.

The dynamics of credentials from ChatGPT accounts compromised in 2021-2023 and leaked on the dark web Source: Kaspersky Digital Footprint Intelligence.

The credential compromises in question stem from infostealer activity, a specialized form of malware designed to steal user credentials for cyberattacks, dark web sales, or other malicious activities. Both personal and corporate devices can be infected by infostealers through phishing emails or websites, public-faced sites with malicious content, and various other means,” says Yuliya Novikova, head of Kaspersky Digital Footprint Intelligence. 

Beyond the volumes of compromised accounts outlined above, the dark web market for credentials can be analyzed from the angle of demand for these accounts – specifically by examining the number of posts in which threat actors offer or attempt to buy infostealer log files containing these compromised credentials. The demand for ChatGPT accounts among cybercriminals spiked in March 2023 after the release of the fourth version of the popular chatbot. Since then, it has stabilized at the same level as other AI services. “This suggests that demand for ChatGPT accounts will remain steady. The importance of robust solutions to safeguard against infostealer attacks and other malware is growing for individuals and companies. For instance, our solution monitors compromised accounts on the dark web and notifies companies if users of their online resources were compromised,” explained expert Novikova.

The dynamics of dark web posts selling or buying accounts from three popular AI services, 2022-2023. Source: Kaspersky Digital Footprint Intelligence

Roblox sets records for compromised credentials, posing a threat to kids

Between 2021 and 2023, almost 34,000,000 credentials for Roblox were compromised and posted on the dark web, turning the game into a very fruitful target for cybercriminals using infostealing malware. Worryingly, the number of accounts compromised for this popular children’s game has increased gradually each year. Over the past three years, this figure rose by 231%, from roughly 4,700,000 in 2021 to 15,500,000 in 2023. In general, the average number of compromised accounts in a combination of 11 other popular gaming platforms or games – Twitch, Electronic Arts, Sony PlayStation, and Steam, amongst others – has increased by 112% since 2021.

The dynamics of Roblox account compromises in 2021-2023. Source: Kaspersky Digital Footprint Intelligence

The reason behind such high volumes of thefts of login credentials associated with Roblox is that children are among the most vulnerable audiences, as they are susceptible to various kinds of social engineering. For instance, cybercriminals can hide infostealers in files containing cheat codes to deceive young gamers. This deception may sometimes appear genuine, as malicious download links can be posted on legitimate and popular social media platforms like YouTube. As a result, many compromised accounts have emerged from a game targeted at children,” explains Yuliya Novikova.

While there are numerous thefts of login credentials on Roblox accounts, they are not the primary goods cybercriminals seek on the dark web. Certain accounts are much more appealing to them: for example, the number of dark web posts selling or buying Steam accounts peaked at approximately 10,000 between 2021 and 2023, while advertisements related to stolen Roblox accounts remained under just 150.

Criminals target game accounts to steal valuable items, such as real money, in-game currency, and various in-game items, such as expensive skins. Steam accounts seem more appealing to cybercriminals criminals due to the potential to find and steal real money from them. Roblox accounts can be exploited to steal in-game currency Robux, pilfer in-game items or gain access to premium accounts that allow items to be transferred to other accounts. While users must exercise caution, platform owners can bolster protection by tracking and promptly blocking compromised accounts through specialized services”, adds expert Novikova. 

To avoid threats related to password leaks, it is worth implementing the following security measures:

  • At a company, organize a proactive monitoring of the dark web to identify account compromises before they impact the cybersecurity of clients and employees. Kaspersky has compiled a detailed guide on how to set up monitoring. 
  • Use Kaspersky Digital Footprint Intelligence to help security analysts explore an adversary’s view of their company resources and promptly discover the potential attack vectors available to them. This also helps raise awareness of existing threats from cybercriminals so you can adjust your defenses accordingly or take timely countermeasures to eliminate threats and remedy the situation.
  • For individuals, protect all the devices you use with a reliable security solution, such as Kaspersky Premium.
  • Use a different password for each service. That way, even if one of your accounts gets stolen, it won’t affect the rest.
  • Wherever possible, protect your accounts with two-factor authentication. Otherwise, comb through account settings.

More articles

Latest news