John Kenneth Schiefer, 26, pleaded guilty to four felonies, including accessing protected computers to conduct fraud, disclosing illegally intercepted electronic communications, wire fraud and bank fraud. He faces a maximum sentence of 60 years in federal prison and a fine of $1.75m, according to documents filed in federal court. He admitted to using botnets to illegally install software on at least 250,000 machines and steal online banking identities of Windows users by eavesdropping on them while they made financial transactions.

Schiefer's software would read Windows "protected store". This is where Microsoft stores the passwords you save online. They claim to encrypt it, but reading the passwords is trivial and no password that Microsoft saves should be considered safe.

Schiefer would then sell the information online. He would also use the 250,000 computers to install adware and other malware on even more machines, receiving a commission for each malware installed. He was paid $14,000 for installing malware on 110,000 machines in one instance and $19,000 in another.

Fuller coverage is here. and here.