Kaspersky Digital Footprint Intelligence estimates that 2.3 million bank cards were leaked on the dark web, based on an analysis of data-stealing malware log files from 2023-2024. On average, every 14th infostealer infection results in stolen credit card information, with nearly 26 million devices compromised by infostealers, including more than 9 million in 2024 alone. Kaspersky released its report on the infostealer threat landscape while the technology world gathers at MWC 2025 in Barcelona.
Kaspersky experts
estimate that approximately 2,300,000 bank cards have been leaked on the dark
web. This conclusion is based on an analysis of the log files from
data-stealing malware, dated 2023-2024, that were leaked on the dark web
market. While globally the share of leaked cards is well below one percent, 95%
of the observed numbers appear technically valid.
Infostealer malware is
not only designed to extract financial information, but also credentials,
cookies and other valuable user data, which is compiled into log files and then
distributed within the dark web underground community. An infostealer can
infect a device if a victim unknowingly downloads and runs a malicious file,
for example one disguised as legitimate software, such as a game cheat. It can
be spread through phishing links, compromised websites, malicious attachments
in emails or messengers and various other methods. It targets both personal and
corporate devices.
Data-stealer threat landscape: 26 million devices found to be compromised over 2023-2024
On average, every 14th infostealer infection results in stolen credit card information. Kaspersky Digital Footprint Intelligence experts found that nearly 26 million devices running Windows were infected with various types of infostealers in the past two years.
The number of infections with data-stealing malware, 2020-2024.
Source: Kaspersky Digital Footprint Intelligence
“The actual number of infected devices is even higher. Cybercriminals often leak stolen data in the form of log files months or even years after the initial infection, and compromised credentials and other information continue to surface on the dark web over time. Therefore, the more time passes, the more infections from previous years we observe. We forecast the total number of devices infected with infostealer malware in 2024 to be between 20 million and 25 million, while for 2023, the estimate ranges between 18 million and 22 million,” says Sergey Shcherbel, expert at Kaspersky Digital Footprint Intelligence.
Beware of Redline, Risepro and
Stealc stealers
In 2024, Redline
remained the most widespread infostealer, accounting for 34% of the total
number of infections.
The most significant
surge in 2024 was in infections caused by Risepro, whose share of total
infections increased from 1.4% in 2023 to almost 23% in 2024. “RisePro is a growing threat. It was first discovered two years
ago, but seems to be gaining momentum. The stealer primarily targets banking
card details, passwords and cryptocurrency wallet data, and may be spreading
under the guise of key generators, cracks for various software and game mods,”
explains Sergey Shcherbel. Another rapidly growing stealer is Stealc, which
first appeared in 2023 and increased its share from nearly 3% to 13%.
Learn more in
the report. In light of this growing infostealer
threats, Kaspersky has launched a dedicated landing page to raise awareness of
the issue and provide strategies for mitigating associated risks.
If you encounter a
data leak through infostealers, the following steps should be taken
immediately:
- Act promptly if you
suspect your bank card details are leaked: monitor bank notifications, reissue
the card and change your bank app or website password. Enable two-factor
authentication and other verification methods. Some banks allow setting
spending limits for added protection. If account and balance details are
leaked, be extra vigilant against phishing emails, fraudulent SMS and calls.
Cybercriminals might consider you a victim for targeted attacks based on this
information. Contact your bank directly in unclear situations.
- Change compromised
account passwords and monitor for suspicious activity associated with
those accounts.
- Run full security
scans on all devices, removing any detected malware.
- Companies are
recommended to monitor dark web markets proactively to detect compromised
accounts before they pose risks to customers or employees. A detailed guide on
setting up monitoring can be found here. Leverage Kaspersky
Digital Footprint Intelligence to track what cybercriminals know about
your company’s assets, identify potential attack vectors, and implement
protective measures in a timely manner.
About the Kaspersky Security
Services
Delivering hundreds of
information security projects every year for Fortune 500 organizations
worldwide: incident response, managed detection, SOC consulting, red teaming,
penetration testing, application security, digital risks protection. The Kaspersky Digital Footprint Intelligence experts
identify suspicious activities on cybercriminal marketplaces and forums to timely
notify an organization.
