For those who have ever wondered how spam still manages to be delivered in the age of Gmail and serious spam filtering, a staggering discovery by a security researcher has uncovered a spambot that had the user credentials for hundred of millions of legitimate email accounts that it uses to send junk email from.

The spambot was discovered by a Paris-based security researcher by the name of Benkow and first reported by Troy Hunt from HaveIBeenPwned.com. The credentials used by the spambot, dubbed “Onliner,” were discovered on an open and accessible web server.

The number of credentials found on the server came in at a staggering 711 million email accounts, that is the usernames and passwords for accounts from Microsoft.com, Gmail, Yahoo and others. Because the details were available on a public server, anyone could access it — meaning that although the data was used by a specific spambot, other spambots could also be using the same user credentials.

The Onliner spambot was found to be using the legitimate email account details to distribute the Ursnif banking trojan virus, a form of malware discovered in 2015 that attempts to steal banking login details from victims. According to a report from Palo Alto Networks Inc. in February, the trojan usually targets people in Japan, but there are reports of variations targeting people in other countries.

Hunt claimed, though it hasn’t been confirmed by other sources, that account credentials come from the 2012 LinkedIn hack. But he noted that he has not tested the entire list. Other reports noted that at least some of the credentials may have come from a Facebook phishing campaign.

Photo: eelkedekker/Flickr