How Did the Hackers Gain Access to iOttie’s Site and Steal Credit Card Information?

A credit card data breach at iottie recently occurred when hackers found a way to gain unauthorized access to the site. This unfortunate incident allowed them to steal valuable credit card information from unsuspecting customers. The breach raises concerns about iOttie’s security measures and highlights the need for heightened security protocols to safeguard personal information from such threats.

Data Theft: A Significant Threat to Business Environments

Recent analysis of nearly 20 million logs of information-stealing malware sold on the dark web and Telegram channels has revealed the alarming extent of infiltration into business environments.

Information stealers are a type of malware designed to pilfer data from various applications, including web browsers, email clients, instant messengers, cryptocurrency wallets, FTP clients, and gaming services. The stolen data is then packaged into archives known as “logs,” which are either used by threat actors for attacks or sold on cybercrime marketplaces.

The most notable families of information stealers, namely Redline, Raccoon, Titan, Aurora, and Vidar, are offered to cybercriminals through a subscription-based model. This allows them to conduct targeted malware campaigns and extract data from infected devices.

While information stealers primarily target careless internet users who download software from unreliable sources, it has become evident that they pose a significant threat to corporate environments as well.

This is due to employees using their personal devices for work or accessing personal content from work computers, resulting in numerous infections that lead to the theft of business credentials and authentication cookies.

A recent report by cybersecurity firm Flare, shared with IT Services, details the presence of approximately 375,000 logs containing access to various business applications such as Salesforce, Hubspot, Quickbooks, AWS, GCP, Okta, and DocuSign[1].

Specifically, Flare’s analysis of the stealer logs revealed:

  • 179,000 AWS Console credentials
  • 2,300 Google Cloud credentials
  • 64,500 DocuSign credentials
  • 15,500 QuickBooks credentials
  • 23,000 Salesforce credentials
  • 66,000 CRM credentials

In addition, there are approximately 48,000 logs that include access to “,” an enterprise-grade identity management service used by organizations for user authentication across cloud and on-premise platforms.

Of all the logs, 74% were found on Telegram channels, while 25% were discovered on Russian-speaking marketplaces such as the “Russian Market.”[1]

The Flare report suggests that the over-representation of logs containing corporate access on Russian Market and VIP Telegram channels indicates a deliberate or incidental focus on targeting corporate entities. Public Telegram channels may intentionally post lower-value logs, reserving high-value logs for paying customers[1].

Source of logs containing business account info
Source of logs containing business account info (Flare)

Furthermore, Flare discovered over 200,000 stealer logs containing OpenAI credentials, twice the amount reported by Group-IB recently. This poses a significant risk of leaking proprietary information, internal business strategies, source code, and more[1].

Corporate credentials, known as “tier-1” logs, are highly valued in the cybercrime underground. They are sold on private Telegram channels or forums like Exploit and XSS. Cybercriminals can leverage compromised credentials to gain access to CRMs, RDP, VPNs, and SaaS applications, and then deploy stealthy backdoors, ransomware, and other malicious payloads[1].

Flare researcher Eric Clay explains that evidence from the dark web forum Exploit suggests that initial access brokers use stealer logs as a primary source to gain a foothold in corporate environments, which can then be auctioned off on top-tier dark web forums[1].

To minimize the risk of info-stealer malware infections, it is highly recommended that businesses enforce the use of password managers, implement multi-factor authentication, and establish strict controls on personal device usage. Additionally, employees should undergo training to identify and avoid common infection channels, such as malicious Google Ads, YouTube videos, and Facebook posts.


[1] Flare Report on Stealer Logs and Corporate Access

Leave a Reply

Your email address will not be published. Required fields are marked *