Over 500,000 stolen Zoom accounts have been spotted online being sold for cents each and sometimes even free, reports BleepingComputer. According to Cybersecurity intelligence firm Cyble, stolen Zoom accounts were spotted selling on hacker forums from April 1st.
The stolen accounts sold, which have also been marketed in the dark web, includes a victim’s email address, password, personal meeting URL, and their HostKey.
Credentials from institutions like University of Vermont, University of Colorado, Dartmouth, Lafayette, University of Florida, and “many more,” were given away for free, according to the cybersecurity firm. Among major companies affected include Chase and Citibank.
The cybersecurity firm went ahead and bought about 530,000 Zoom credentials for $0.0020 each to warn their customers about the potential threat that lied ahead.
For affected Cyble customers, the firm was able to prove that they were valid credentials and warned their users.
This isn’t Zoom’s fault, however. These credentials were allegedly obtained through credential stuffing attacks, which involve matching leaked credentials with passwords obtained in data breaches to gain access to an account.
In response, Zoom says they have already hired “multiple intelligence firms” to hunt for these “password dumps and the tools used to create them.”
“We continue to investigate, are locking accounts we have found to be compromised, asking users to change their passwords to something more secure, and are looking at implementing additional technology solutions to bolster our efforts,” the company said, in a statement.
Zoom’s business has boomed in recent months, from just 10 million users to 200million active users in a day as of March. Besides, they have also been under fire for their lax security and privacy measures, but the firm has expressed its strong urge to get their shit together.
Follow us on Telegram, Twitter, Facebook, or subscribe to our weekly newsletter to ensure you don’t miss out on any future updates.
One Comment