Spyware authors are now offering financial rewards to botnet operators and other cyber criminals who covertly install their spyware.

Selling "installs" is a common practice in the cyber-underworld, the most notable example was in 2005 when Jeanson Ancheta was arrested for building a 400,000-strong botnet and installing adware from 180 solutions for $60,000. But now the criminals have moved in a riskier direction to spyware which is illegal to download and designed to evade anti-virus detection.

The income that can be earned grows based on higher numbers of installs, which implies that the spyware is to be used with botnets and varies based on the geographical location of installation. For example, installing spyware on 1,000 machines in Australia earns $100 but only $50 in the US. Below is a sample price list:

Country: Price $ USD per 1000 unique loads:
US 50
UK 60
NL 25
FR 25
PL 18
IT 60
DE 25
ES 25
AU 100
GR 25
Other 18
Asia 3

The code is first added to a Web page which may be a phishing site, a hacked site, a site hosted on a Web server or even a botnet-hosted Web page. Instruction is then issued to the offending botnet computers to visit the page, download the code and execute it. Once the spyware is installed, it would register with the "seller" and the "affiliate" would then be paid.

This site is reminiscent and may be the same as another Russian site called iframedollars.biz that existed until recently. A simple line of code is added to an HTML page that will in turn cause a drive-by-install of spyware to the computers of any visitors to that site. MessageLabs first reported on this phenomenon in May when a staggering $11,890 was reported to have been paid out in one week alone.

While MessageLabs has not yet identified what the downloaded spyware does, it is updated every three days to evade detection. The site reads, "Our program (size: 3 Kb) is loaded to the user and it changes the homepage and installs toolbar and dialer. It’s activated and revealed in 15-30 minutes after download."