Symantec recently gained access to and closely monitored two FTP servers related to the Qakbot botnet and made a startling discovery: Qakbot is uploading two gigabytes of stolen confidential information to each of its FTP servers each week.

The stolen information includes online banking credentials, credit card information, social network credentials and e-mail account details. In a nutshell, every bit of information an infected user types into their browser is stolen. In addition, the Qakbot author or authors have not put much effort into securing the stolen information. Thus, anyone with nefarious intentions and a sample of the threat can access the stolen data quite easily.

Perhaps even more disturbing is that Symantec has observed Qakbot almost equally effective at stealing information from corporate environments as from home users.

In light of the growing trend of targeted attacks against enterprises identified in the recently released Symantec Internet Security Threat Report XV, Symantec is urging Enterprises to be particularly wary of this threat because it also functions as a downloader, leaving compromised corporate environments open to a more serious attack if appropriate action is not taken right away.