What to do against increasing data theft

According to the Threat Report data published by the cybersecurity company ESET for the first six months of 2024, there is an increase in the number of information thieves.

Malicious software aimed at information theft is not limited to pirated games, applications, and cheat tools; it also targets users by imitating generative artificial intelligence tools.

Experts state that such malicious software steals valuable information on your computer and can access not only usernames and passwords accessed via web browsers but also information belonging to applications.

WHAT IS INFORMATION THEFT?

Information stealers are generally a type of malware sold as a service.

For this reason, exactly what it does while on a computer will vary depending on what the criminal who bought it wants to search for and steal. They usually delete themselves after finishing the theft to make it difficult to determine what happened and when.

If the person whose information was stolen does not take immediate action, this gives criminals more time to use or sell the information stolen from the computer.

It is also possible that information stealers have been used to install additional malware on the system to maintain access, in case they decide to return to the computer in the future to see if there is anything new to steal.

WHAT CAN BE STOLEN WITH MALICIOUS SOFTWARE?

Game accounts can be stolen, valuable items can be looted, used to purchase gifts, or resold in their entirety.

Media accounts such as email and social media can also be resold.

They can use your account to convince your online friends to download and run the information stealer, turning them into new victims and allowing their puppeteers to spread from these accounts indefinitely.

What is stolen is not just usernames and passwords. It can be cryptocurrency wallets or account session tokens. The information stealer can sell the email address it finds to other criminals to later send scam or blackmail emails.

Some websites and applications have a "remember this device" feature that allows you to access the service without having to log in again or enter your second authentication factor. This is done by storing a session token on your device. You can think of this as a special form of web browser cookie that tells the visited website that the user's identity has been successfully verified and to allow them in. Criminals look for and target these because they allow them to log into an account by bypassing normal checks. As far as the service is concerned, it just looks like you are accessing it from your previously authorized device.

WHAT CAN YOU DO TO RECOVER YOUR COMPUTER?

Unless the computer's drives need to be kept as evidence, the first thing to do would be to wipe the computer's drive and reinstall the operating system. This assumes that the computer is backed up regularly, so wiping the drives and losing all information stored on it is not a major problem because it is already backed up elsewhere. If this is not the case and valuable, important data is stored on the computer, it might make sense to remove the drives, replace them with an empty drive, and perform a clean installation of the operating system on it. It will also be important to get some kind of external enclosure to insert the drive later to copy unbacked-up data.

After wiping the computer, installing Windows, installing security software, and updating all of these, you can start using the computer to access the internet to change the passwords of all online accounts accessed from the computer.

Each password should be replaced with one that is not only complex but also different for each service. If one of the passwords is lost or guessed, the attacker cannot guess what the other passwords might be.

Enabling two-factor authentication will make it exponentially harder for attackers to take over these accounts in the future, even if they know the passwords. When changing passwords, it is important that they are unique or different from previously used passwords. If new passwords are similar enough to old passwords, a criminal who has all the old passwords will most likely be able to make all kinds of educated guesses about what the new passwords for various services might be. Make sure you do not cycle through similar-sounding or previous passwords.

It is not just passwords that you need to change, but also session tokens. These are the targets of information-stealing malware because they allow criminals to impersonate you by taking over one of your previously authorized sessions. Some websites and applications have the ability to show you other active sessions or the devices you accessed them from, and at the same time, the ability to log out or disconnect from these other active sessions.

STEPS YOU CAN TAKE TO REDUCE THE IMPACT OF ATTACKS AND ENSURE FASTER RECOVERY:

Use long and different passwords for every website and application. A password manager can make this complex process much easier for you.

Enable two-factor authentication for all services that allow it. Hardware tokens or smartphone apps are more secure than email or SMS notifications, as an attacker might have access to your email or smartphone.

Some services allow you to see all devices logged into your account. Review them periodically and disable those you do not recognize or that have not been active for a while.

Use a data breach monitoring or identity theft protection service to notify you of compromised accounts.

No matter how reliable you think they are, do not use pirated software, cracks, keygens, or similar tools. It is very easy for criminals to make these look reliable when they steal the accounts that rate them.

Keep your operating system and applications updated with the latest fully patched versions.

Use the latest versions of security software from reliable, well-established vendors.