Researchers have discovered the leak of a huge set of sensitive data, an astonishing 1.2 TB database containing login credentials, browser cookies, auto-fill data and payment information extracted by the yet-to-be-identified malware.

Researchers from NordLocker, a security company developing the encryption software of the same name, said the database contains 26 million login credentials, 1.1 million email addresses, and more than two billion browser cookies. and 6.6 million files.

In some cases, the victims stored the passwords in text files created with the Notepad application.

The leak also included more than one million images and more than 650,000 files in Word and PDF formats.

In addition, the malware took a screenshot after infecting the computers and took a picture using the device's webcam.

The stolen data also came from messaging, email, games and file sharing apps.

The data was extracted between 2018 and 2020 from more than 3 million personal computers.

The discovery comes amid an epidemic of security breaches using ransomware and other types of malware affecting large corporations, including the May ransomware attack on Colonial Pipeline, in which hackers for the first time managed to From accessing hacked employee accounts.

There are many of these leaks available for sale online.

Oftentimes such data is collected by compromised malware installed by an attacker trying to steal cryptocurrency or commit a similar type of crime, said Alon Gal, co-founder and chief technology officer of security firm Hudson Rock.

Gal adds that the attacker "will then most likely try to steal the cryptocurrency, and once they are done with the information, will sell groups with expertise in ransomware, data breaches, and corporate spying."

"These hackers capture browser passwords, cookies, other files and much more and send them to the attacker's (command and control server)."

Nord Locker researchers said the attackers did not lack the physical and technical resources to secure such information.

Custom malware for these purposes can be obtained by anyone. It is cheap and customizable (Reuters)

"The truth is that malware can be obtained by anyone for these purposes...it is cheap, customizable and can be found all over the web. Dark web advertisements about these viruses reveal more about the prevalence of this market," the researchers wrote.

For example, anyone can get their own malware and even lessons on how to use stolen data for less than $100, advertisers promise that they can create a virus to attack almost any application a buyer needs.

Nord Locker was unable to identify the malware used in this case.

Gal said that from 2018 to 2019, widely used malware included Azorult and, more recently, an information thief known as Raccoon who, once infected, would regularly send the stolen data to a command and control server operated by the attacker.

Overall, the malware collected account credentials for nearly a million websites, including Facebook, Twitter, Amazon, and Gmail.

Of the 2 billion cookies that were extracted, 22% were still valid at the time the incident was discovered.

People who want to determine if their data was obtained by malware can check the hack notification service through the

Have I Been Pwned

website,

which has just uploaded a list of compromised accounts.