# Data theft is a business anyone can buy into

**Data theft business** models have industrialised what used to require technical skill. A tool called Evil Extractor was sold by subscription, advertised as a legitimate utility and promoted mainly on criminal forums to people looking for easy income. Seven attack modules covered ransomware, credential extraction and the bypass of Windows Defender, with checks on date and time, anti-sandbox, anti-virtual-machine and anti-scanner logic, FTP server configuration and log deletion.

## How the toolkit worked

After installation, three components written in Python handled different tasks. The first extracted cookies from Chrome, Edge, Opera and Firefox, together with browsing history and saved passwords from a range of other programs. The second acted as a keylogger, storing everything typed by the victim in a local folder. The third activated the webcam silently, recorded video or images and uploaded them to a server chosen by the operator. The toolkit also collected documents, media files and screenshots, and the ransomware module created a password-protected archive of the victim's files to make them inaccessible.

Distribution relied on phishing email that appeared to request an account confirmation. The message carried an executable compressed with gzip and disguised as a PDF. Opening it started a PyInstaller file, which launched a .NET loader that used an encoded PowerShell script to run the malicious executable. The chain is typical of commodity malware: each layer hides the previous one and delays detection.

## Who carries the consequences

The damage goes beyond the affected device. Stolen credentials, personal documents and private images affect the people whose data the company holds, and under the GDPR the company is accountable for how that data is protected. An organisation without adequate security resembles someone leaving private letters, quotes, bank details, credentials and contracts on a public street. Negligence and careless handling carry legal penalties, and the reputational cost arrives before any fine.

Apple systems are not immune to this class of threat. The impact appears smaller because their market share is smaller, which changes how visible the attacks are rather than whether they happen. The lesson is the same across platforms: [the value of the data makes it a target](/en/ecorner/2023/google-dark-web-data-protection.html), and the tools to reach it are cheap.

## Why the subscription model matters

When criminal capability is packaged and sold, the barrier to entry drops to the price of a monthly subscription. That changes the threat calculation for every company, because the attacker no longer needs expertise, only a target. The defensive response is proportionate: strong authentication, endpoint protection that is actually maintained, tested backups, staff training that addresses phishing and a clear owner for data protection. None of these is exotic, and each one removes an opportunity the toolkit depends on.

## Frequently asked questions

**What is malware-as-a-service?**
It is criminal software sold or rented as a product, often with support and updates, which lets people without technical skills run attacks.

**How does this kind of malware usually arrive?**
Through phishing email with an attachment disguised as a document, or through a malicious download that installs the payload when opened.

**Is a small company a realistic target?**
Yes. Automated tools scan for any accessible target, and small companies often hold the customer and financial data that makes an attack worthwhile.

**What is the first defensive step?**
Multi-factor authentication on critical accounts and tested offline backups. Both limit the damage even when a device is compromised.

## Sources

European Commission — data protection in the EU and the GDPR — https://commission.europa.eu/law/law-topic/data-protection_en
Garante per la protezione dei dati personali — https://www.garanteprivacy.it/
ENISA — threat landscape and malware trends — https://www.enisa.europa.eu/
CISA — guidance on phishing and ransomware — https://www.cisa.gov/stopransomware