Ukraine identifies information theft operator linked to 28,000 stolen accounts

Ukrainian cyber police, working with U.S. regulation enforcement companies, have recognized an 18-year-old man from Odesa suspected of working an information-stealing malware operation focusing on customers of a web based retailer in California.

Based on Ukrainian police, the attacker used information-stealing malware in 2024-2025 to contaminate customers’ units and steal browser periods and account credentials.

Infostealer is a typical kind of malware that collects delicate information comparable to passwords, browser cookies, session tokens, cryptocurrency wallets, and cost data from contaminated units and sends it to cybercriminals for account theft, fraud, and resale.

The assault linked to this younger hacker affected 28,000 buyer accounts, of which the cybercriminals used 5,800 to make fraudulent purchases totaling roughly $721,000. This malicious operation resulted in a direct lack of $250,000, together with chargebacks.

“To hold out their felony plan, the attackers used ‘infostealer’ malware that secretly contaminated customers’ units, collected login credentials, and despatched them to attacker-controlled servers,” police stated.

“The knowledge was then processed and bought by means of specialised on-line assets and Telegram bots.”

Based on police, the suspect was conducting digital forex transactions together with his accomplices.

The “session information” talked about within the police launch refers to session tokens that can be utilized to log right into a sufferer’s account with out requiring credentials, and in some circumstances even bypass multi-factor authentication (MFA) checks.

Police stated the 18-year-old suspect managed the web infrastructure used to course of, promote and exploit stolen session information, suggesting he performed a central function within the operation.

Police searched the suspect’s dwelling twice and seized cell phones, pc gear, financial institution playing cards, digital storage media and different digital proof supporting his involvement in unlawful actions.

Proof consists of entry to assets used to promote stolen information or handle compromised accounts, server exercise logs, and accounts on cryptocurrency exchanges.

At this stage, authorities have recognized the suspect, carried out an investigation, and seized gear and different proof linked to the suspect and the operation.

Nevertheless, the announcement didn’t point out any arrests, suggesting that investigators should still be growing the case earlier than formally indicting them.