Stealing credentials via Trojans like Zeus and SpyEye has become so simple and prevalent that cybercriminals are finding themselves with a surplus: Two cybercrime gangs are now advertising bulk-rate Facebook, Twitter, and cPanel credentials in order to clean out their inventory.

Researchers at Trusteer say these credential "factory outlets" are a way for the bad guys to cash in on other credentials they pilfered while stealing online banking credentials. It's like making money off the chaff that comes along with the ultra-valuable online banking credentials lifted by Trojans and keyloggers: "They harvest a lot of things" unrelated to the stolen online banking credentials, says Yishay Yovel, vice president of marketing for Trusteer, whose company discovered the sales. "This is how they monetize the [leftover] assets they harvest."

The ads were running in underground forums infiltrated by the researchers from Trusteer.

In one of the advertisements in the underground, the thieves are offering bulk and country-specific credentials, as well as other personal information they nabbed, such as emails. They claim to have some 80 gigabytes worth of stolen victim information.

Another ad, apparently from a botnet operator, sells cPanel credentials and URLs that would allow you to wrest control of the victim websites. cPanel is a control-panel application used for managing hosted websites.

"That was very interesting, with cPanel control software for websites," Yovel says. Getting access to user credentials for that application would provide attackers with another more targeted way to infect websites.

Trusteer believes attackers could then lure users to those sites via phishing emails and social networking messages.

Read the rest of this article on Dark Reading.

There are no silver bullets when it comes to protecting company and customer data from loss or theft, but there are technological and procedural systems that will go a long way toward preventing a WikiLeaks-like data dump. Download our How To Prevent An Online Data Dump report. (Free registration required.)