In the mid-2000s, ICQ was the most widely used instant messenger on the Russian-speaking internet, and short, memorable ICQ numbers (UINs) were worth money. In May 2008, Kaspersky reported that ICQ number theft had been going on for years and was carried out mainly with the LdPinch family. LdPinch collected not only ICQ but also email, FTP and gaming accounts.
There is no reliable total of affected users.
LdPinch searches the computer for saved accounts. It looks at passwords kept by ICQ, email, FTP and game programs.
The user receives an ICQ message with a photo or file link from someone on their list. The download looks like a screensaver or an image; running it installs LdPinch. LdPinch collects the ICQ number and password along with email, FTP and gaming accounts and sends them to the attacker. Valuable numbers are put up for sale; other accounts are used to spread the same message to contact lists.
Also known as: Trojan-PSW.Win32.LdPinch
There was no single outbreak; users kept losing accounts for years and the theft turned into a market. Kaspersky reported that shops selling “beautiful” ICQ numbers engaged in industrial-scale password guessing and account theft, and that some malware sellers sold stolen numbers in their own stores.
There is no reliable total of affected users. Its lasting impact was forming one of the earliest versions of an economy that collects, packages and sells credentials.
What LdPinch did is now called an infostealer: software that collects browser, messaging, gaming and wallet data and sends it as a single “log”. The ICQ number market has been replaced by markets selling stolen session and credential logs.
See your firm's attack surface on one screen: how many findings, at which severity, on which domain.
We use cookies to ensure proper operation of our website, analyze usage, and deliver relevant content and advertisements. You can manage your preferences at any time. Cookie Policy