John Schiefer, 26, known online as "acid" and "acid storm," admitted to infecting and hijacking more than 250,000 PCs with malware so he could have access to PayPal records.

Schiefer recently agreed to plead guilty to four counts of fraud and wiretap charges that could send him to federal prison for 60 years with fines up to $1.75 million USD according to the Los Angeles U.S. Attorney's office.

Schiefer used the zombie machines to steal usernames and passwords to the online PayPal payment service. According to U.S. Attorney Mark Krause, Schiefer is the first person to be accused by the U.S. government under the federal wire tapping law of operating a botnet -- a network of hijacked computers.

Along with the PayPal botnet, Schiefer was hired by multiple clients to service PCs, but ended up installing malicious code designed to steal usernames and passwords for online banking accounts. Prosecutors also accuse him of defrauding a Dutch Internet advertising company, which put him on the payroll to install software with user permission -- however, the software instead allowed him to steal more personal information.

The U.S. Attorney's office is attempting to discover how many people may have had their account information compromised.

Investigators are now turning up the heat trying to stop groups from creating botnets to steal personal information.

"We have seen a dramatic uptick in the last few years in the number of botnets being used to give their masters direct financial gain," said Jose Nazario, Arbor Networks senior researcher.