Have I Been Pwned adds 441K accounts stolen by RedLine malware

The Have I Been Pwned data breach notification service now lets you check if your email and password are one of 441,000 accounts stolen in an information-stealing campaign using RedLine malware.

RedLine is currently the most widely used information-stealing malware, distributed through phishing campaigns with malicious attachments, YouTube scams, and warez/crack sites.

Once installed, the RedLine malware will attempt to steal cookies, credentials, credit cards, and autocomplete information stored in browsers. It also steals credentials stored in VPN clients and FTP clients, steals cryptocurrency wallets, and can download additional software or execute commands on the infected system.

The stolen data is collected into an archive, called “logs,” and uploaded to a remote server from where the attacker can later collect them.

Attackers use these logs to compromise other accounts or sell them on dark web criminal marketplaces for as little as $5 per log.

RedLine logs publicly exposed

Last weekend, security researcher Bob Diachenko found a server exposing over 6 million RedLine logs collected in August and September 2021. The threat actor likely used this server to store stolen data but failed to secure it properly.

Redline Stealer malware logs with more than 6M records were exposed online, publicly (now taken down). Internationally sourced data, exfiltrated in Sept and Aug 2021. RS is the key source of identity data sold on online criminal forums since its initial release in early 2020. pic.twitter.com/kv9MNL8hAE

— Bob Diachenko (@MayhemDayOne) December 25, 2021

Diachenko told BleepingComputer that while this data contains 6 million records, many had the same email address used for different services.

This week many LastPass received emails warning that their master passwords may be compromised as they were used to log in from an unusual location.

Diachenko found that numerous LastPass credentials were stolen and stored in the exposed RedLine logs and checked various emails for LastPass users who received the emails to see if they were listed.

let’s try, pls dm your email

— Bob Diachenko (@MayhemDayOne) December 28, 2021

Diachenko told us that the server is still accessible but no longer appears to be used by the threat actors as the number of logs has not increased.

To make it easier for others to check if a hacker stole their data in the exposed RedLine malware campaign, Diachenko shared the data with Troy Hunt, who added it to his Have I Been Pwned service.

The RedLine data contains 441,657 unique email addresses stolen by RedLine that can now be searched on Have I Been Pwned.

Unfortunately, if your email address is listed in the RedLine malware logs, it’s not enough to just change the passwords associated with that email account.

As RedLine targets all of your data, you must change your password for all accounts used on the machine, including corporate VPN and email accounts, and other personal accounts.

Furthermore, as RedLine attempts to steal cryptocurrency wallets, you should immediately transfer the tokens to another wallet if you own any.

Finally, if your email is listed as part of the RedLine records, you should scan your computer using an antivirus software to detect and remove any installed malware.