Student Arrested for Selling Keylogger that Infected thousands of devices

A malware developer from Great Falls, Virginia created a keylogger having the capability of recording every single keystroke on a computer and sold it to over 3,000 people. As a result, around 16,000 systems were infected.

The US Department of Justice released a press release revealing that the 21-year old hacker Zachary Shames was arrested and has now pleaded guilty to developing and selling customized spyware to record keystrokes on a targeted computer.

Shames is currently a student at James Madison University. According to the press release, Shames developed the first version of the spyware in 2013, when he was just a high school student. He then continued to improvise the software and also distributed the product from his “college dorm room.” Shames’ LinkedIn profile states that he was also an intern from May 2015 until August 2016 for Northrop Grumman, a defense contractor.

Currently, the feds have released basic information on this case and nothing about the criminal complaint, or the indictment is posted online. The only publicly available document is the one in which Shames is accused of aiding and abetting computer intrusions through marketing and selling his “malicious keylogger software,” with full knowledge and awareness about the way this software was going to cause damage to computer systems.

The spyware has been referred to as “malicious keylogger software,” but it was actually dubbed as the “Limitless Keylogger Pro,” according to a security researcher’s findings. This software was being marketed on Hack Forums since 14th March 2013 by someone using the username Mephobia. The seller asked for a $35-lifetime subscription and payment was requested via PayPal and bitcoins.

Reportedly, Shames is due to receive a sentence on June 16th and expects to get a maximum sentence of 10 years in jail.

More: Websites of Pakistan Army, Vatican Catholic Church and Italian Chamber of Commerce Vulnerable to SQL Injection

This is not the first time when HackForums has been in the news for wrong reasons. About three months ago, the forum had to shut down their (SST) Server Stress Testing section because it is suspected to have offered paid distributed denial-of-service (DDoS) attacks on Dyn.