What is crimeware? Everything you need to know

Any malware can be crimeware if it’s used for illegal purposes. But crimeware doesn’t always have to be malware. It can be any software for illicit activities, such as software kits for phishing attacks.

While crimeware is typically associated with software-based attacks, it can also be hardware based. For example, criminals can connect hardware keyloggers to steal passwords in your workplace or use packet sniffers for man-in-the-middle attacks on public Wi-Fi.

The way most crimeware works is like malware. Your device gets infected when you click on links in phishing emails, download files from malicious or fake websites, or fall for any social engineering techniques.

It’s also possible to get infected by visiting a compromised website or using outdated software.

After crimeware programs end up on your device, they can:

• Stay hidden and observe your activities or log your keystrokes. This way, criminals can get your passwords, credentials to online bank accounts, or other sensitive data.
• Use your computer for malicious purposes. For example, they can employ your device as a bot for DDoS attacks, make it mine cryptocurrency, or use it to send spam and scam emails.
• Encrypt your device and ask for a ransom payment.

Some crimeware programs don’t work as malware. Instead, criminals use them to automate their activities or enable their illicit actions in other ways.

A phishing kit, for example, is crimeware attackers use to create convincing phishing emails or fake websites. It allows criminals to advance their fraudulent activities even when they don’t have enough tech knowledge or skills to start attacks from scratch.

Ultimately, the specific functionality of crimeware depends on its type and purpose.

Crimeware includes a wide range of malicious software and code used for cybercrime. Here are some of the main types of crimeware:

Trojan horse

A trojan is malicious software that disguises itself as a legitimate program, such as a video game or browser toolbar. All you see are the valuable functions while in the background, criminals are getting remote access to your device or stealing your financial information.

Criminals often use Trojan horses for fraudulent transactions or identity theft.

RAT

A remote access trojan (RAT) is a Trojan horse that gives a criminal remote control over a victim’s computer. Criminals can then perform various malicious activities, such as stealing confidential data or installing additional malware.

Adware

Adware is software that displays unwanted advertisements on a victim’s computer or mobile device. While adware doesn’t always have criminal intentions, when used as crimeware, it often shows fraudulent advertising or spreads other malware once installed.

Rootkit

A rootkit is a crimeware that hides its presence by modifying the operating system. It makes its presence undetectable, so it’s challenging to remove rootkits.

Like trojans, rootkits can enable remote access to the device so criminals can do all kinds of damage.

Spyware

Spyware is crimeware that collects information from a victim’s computer or mobile device without their knowledge or consent.

Depending on the type of spyware, it can get a hold of your browsing history, record your keystrokes and screen activity, or take over webcam video and audio.

Keylogger

A keylogger is a type of spyware that focuses on recording your keystrokes. The hackers log everything you type on your device to get your login credentials, payment card details such as your credit card security code, or other sensitive information.

Keyloggers can be both software and hardware based. In the case of software keyloggers, your device can get infected the same way it can with any other malware. Meanwhile, hardware keyloggers must be planted and connected to the target’s device.

Virus

A virus is a malicious code or software replicating itself to spread from one computer or device to another. It usually requires the victim’s interaction to execute the malicious code. Once successful, viruses can cause damage to victims’ files, applications, or operating systems.

Worm

A worm is self-replicating crimeware that can spread across a network or the internet without human interaction. It can steal sensitive data or install other malware in the process.

Once criminals infect your device with crimeware, they can use it for various attacks. Here are the most common examples of crimeware attacks:

Identity theft

Crimeware for identity theft aims to steal personal information such as name, address, Social Security number, or any other information that criminals can use to impersonate the victim.

If attackers succeed, they can use stolen information for fraudulent activities – opening online bank accounts, taking out loans, or making purchases in the victim’s name.

Data theft

Even if the stolen data is not enough for identity theft, it can still be profitable. Criminals can use stolen passwords, credit card numbers, or bank account details for financial fraud. They can also sell valuable data on the dark web for other criminals to use.

DDoS attacks

Criminals can hijack a victim’s device and turn it into a bot for distributed denial of service (DDoS) attacks.

Crimeware hijacks many computers or IoT devices and uses them to flood a specific target, usually a website, with traffic. The targeted web server then becomes inaccessible to legitimate users.

Owning a botnet of hijacked devices is lucrative. Criminals can use it for extortion or sell their DDoS attack services on the dark web.

Criminals also use hacked email accounts or hijacked devices to send spam and scam emails. These emails can sell fake products, distribute malware, or include phishing links.

Ransomware

Ransomware encrypts the victim’s files or entire device and demands payment for the decryption key. The goal is to extort money from the victim by holding their data hostage.

Cryptojacking

Criminals can use the device infected with crimeware to mine cryptocurrencies. Since crimeware hijacks the device’s processing power, cryptojacking can cause the infected machine to slow down or crash. It can also increase electricity costs for the victim.

Pharming

Pharming attacks happen when fraudsters use crimeware to redirect a victim’s web traffic from a legitimate website to a fake website.

The scam website usually looks identical to the real one, so criminals can steal sensitive information, such as login credentials or credit card numbers.

Session hijacking

In session hijacking attacks, crimeware intercepts and takes over a legitimate user’s session on a web application.

Once the criminal has control of the user’s session, they can perform actions on the user’s behalf, such as making unauthorized transactions or accessing sensitive data.

Preventing crimeware is often tricky because it involves technical measures and user awareness. Here are some steps you can take to help avoid crimeware attacks:

• Keep your software up to date. Regularly install security patches and updates for your operating system, web browser, and other programs. This way, you can eliminate security vulnerabilities before criminals exploit them.
• Use strong and unique passwords. Use a different secure password for each account and enable multi-factor authentication (MFA) wherever possible. Doing so can help prevent attackers from accessing your accounts and stealing sensitive information.
• Install and use security software. Install a reputable malware protection tool and keep it up to date. It can help detect malicious downloads before they end up on your device.
• Be cautious when opening attachments or clicking on links. Don’t open attachments or click on links in emails or messages from unknown senders. Suspicious emails can include phishing links and malware attachments.
• Use a virtual private network (VPN). When connecting to public Wi-Fi, use a VPN to encrypt your traffic and protect your data from interception by attackers.
• Back up your data. Ransomware attacks can make getting your data back impossible, but a recent backup can help you recover your data.
• Pay attention to your device. Sometimes negligible symptoms, such as weaker device performance, can indicate a hacked phone or computer. Noticing and examining suspicious behavior can stop crimeware in its tracks.
• Stay informed and educated. Keep up with the latest threats and attack techniques, and educate yourself on staying safe online. Reading our blog is a good start.

Yes and no.

A VPN can prevent some types of crimeware attacks because it prevents criminals from intercepting your internet traffic to steal your sensitive information.

But a VPN alone is usually insufficient to protect against all types of crimeware. For example, a VPN cannot stop you from downloading malicious software or submitting your passwords on phishing websites.

Then again, NordVPN can do much more than a regular VPN – its additional Threat Protection feature can block malicious downloads and prevent you from landing on dangerous websites.