The scale of the threat posed by cyber-criminals has been revealed after researchers took over a network of computers for ten days, gaining unrestricted access to thousands of bank and credit card accounts.

They showed how a botnet, a network of 180,000 compromised or zombie computers, allowed thieves to steal thousands of bank account and credit card details and computer passwords and to spy on the browsing habits of the users.

In an unprecedented insight into how "botnets" operate and how lucrative they can be, security researchers at the University of California, Santa Barbara, estimated that they could have sold the information that they collected for more than $8 million (£5.31 million) on the thriving underground market for stolen data.

There are thousands of separate botnets operating around the world — many bigger than the Torpig botnet that was hijacked by the department of computer science reseachers who took control from its cyber-criminal creators in January by setting up a server to intercept communications from zombie machines. The hijack lasted ten days before the botnet's controllers updated their system.

Torpig is a type of malicious software called a Trojan that hides in infected computers, allowing them to be controlled remotely. It can be used to gather personal and financial information from Windows users. Machines become infected when users click on phishing e-mails, designed to try to gain sensitive information, or visit compromised websites, according to security experts.

Typically, on an infected machine when a user tries to visit one of 300 common financial websites, the Torpig programme makes a fake site pop up instead and prompts the user for log-in or financial information.

In ten days, the researchers collected the credentials for 8,310 accounts at 410 institutions, including 1,770 accounts with PayPal, 314 at CapitalOne and 217 with Chase. Also stolen were 1,660 credit and debit card details, mostly Visa and Mastercard.

The victims were in more than 40 countries but were mainly in the US, Italy and Spain.The researchers said that they tried to minimise damage to the victims and contacted internet service providers and law enforcement agencies to hand over any stored data. The servers used by the cybercriminals were then closed down.