Qakbot 2023 Data Breach

Qakbot Banking Malware Botnet Seizure (2023): 6.4 Million Victim Email Addresses Exposed :: FBI Operation Duck Hunt

Malware / Botnet · Banking malware and botnet operations · Malware botnet infrastructure · Global

Qakbot Banking Malware Botnet Seizure (2023): 6.4 Million Victim Email Addresses Exposed :: FBI Operation Duck Hunt

malware or botnet infrastructure rather than a consumer-facing service

Compilation · ObscureIQ Intelligence
Limited DisclosureThis data comes from an illicit online community. Because merely appearing in it could wrongly imply involvement, we do not confirm anyone’s presence publicly or allow third parties to look others up.
Breach Risk Index i
44/100
Lower riskHigher risk
Moderate: notable exposure with meaningful misuse potential.
Data Sensitivity i
Restricted
Being associated with this breach can itself be harmful. Disclosure is limited and presence is not confirmed to unverified parties.
6.4MRecords
2023Year

The Breach Risk Index (BRI) is a proprietary 0–100 score rating how dangerous a breach is right now, based on how recently the data has been circulating on the dark web and how valuable it is to attackers.

Classification Tags
QakbotMalware / InfostealerCybercrimeThreat Actor InfrastructureUsers2023

Breach Summary

This record represents roughly 6.4 million credential pairs that the Qakbot malware stole from victims and that law enforcement recovered during the August 2023 Operation Duck Hunt takedown. The recovered data, shared with HIBP, consists of email addresses and passwords harvested from infected machines. It is a compilation of malware-stolen victim credentials, not a breach of a single organization.

Full threat analysis, exploitation vectors, and principal guidance below.

12 additional sections · verified field analysis · defensive doctrine

Querying breach corpus…
Cross-referencing exposed field types…
Resolving threat-actor attribution…
Compiling principal risk advisory…

6.4M records analyzed

About Qakbot

Qakbot (also known as Qbot) was a long-running malware and botnet operation used to steal credentials and deploy ransomware across hundreds of thousands of infected computers worldwide.

Why They Hold Your Data

Malware botnet infrastructure typically accumulates stolen credentials, infected device identifiers, system metadata, browser data, email-related information, and command-and-control telemetry needed to manage compromised machines and monetize access. Its workflows generate data through infection, credential capture, device profiling, and centralized collection from large numbers of endpoints.

Recent Developments

In August 2023, the FBI-led Operation Duck Hunt disrupted Qakbot, seized infrastructure and cryptocurrency, and recovered stolen credentials that were shared with Have I Been Pwned and a Dutch police "Check Your Hack" portal.

Data Points Exposed

2 verified field types
Email Address
Password High

Breach Impact

Because these are live credentials captured by an infostealer, many were valid at time of theft, creating direct account-takeover risk across whatever services victims used them on until reset.

Exploitation & Downstream Threats

• Credential stuffing against reused passwords across other platforms | • Targeted phishing campaigns using exposed email addresses

Principal Risk Advisory

What this means for a principal

A consumer-service breach: contact and account data supports phishing, account takeover and profile enrichment. For a high-profile principal the main risk is credible impersonation and enrichment of existing exposure.

What You Should Do

  1. Reset any reused passwords and enable MFA on email first, then financial accounts.
  2. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

  1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
  2. Exposure mapping: cross-reference the exposed identifiers against broker-available data to size and prioritize the principal's wider footprint.
  3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).
Q
Threat Actor: QakbotConfidence: High
Botnet / malware operators

Motivation: Financial gain, malware delivery
Operators of the Qakbot banking-trojan-turned-loader active since 2007-2008; evolved into a major ransomware delivery and access-broker botnet before an August 2023 multinational takedown (Operation Duck Hunt).

Read the full threat-actor profile →
This breach is linked to the LE malware takedown (Endgame / Genesis / Duck Hunt) campaign. See the full campaign analysis →

Protect Yourself

High-Risk? Get an Exposure Audit

Executives, public figures, and high-visibility operators can receive tailored exposure intelligence and hardening guidance.

Request Consultation