A man and a woman have been arrested for allegedly using a “sophisticated and malicious” virus to infect tens of thousands of computers and steal millions of pounds worth of personal information.

The virus, known as ZeuS or Zbot Trojan, bypasses security safeguards to record online bank account details, passwords and credit card numbers.

It also copies passwords for social networking sites before causing each computer to forward the data to servers under the control of the hackers.

It has emerged in several guises, including a false Facebook page that encouraged users to download a software update. The information is potentially worth millions of pounds to organised criminals — either to sell or to use themselves.

Police said the virus “posed a threat to the internet globally”.

Officers at the Metropolitan Police’s e-crime unit arrested the man and woman, both aged 20, in Manchester at the beginning of the month but the details of the investigation have just been released. Both are British and were found at the same address.

Detective Superintendent Charlie McMurdie, who heads the unit, said the suspects were the first people in Europe to be arrested in connection with the scam. “This is known internationally as being a very sophisticated and malicious computer program or ‘malware’ that is used for infecting or accessing personal information and in this instance we have 10,000 computers worldwide that have been infected.

“Suspects are harvesting millions of lines of data from infected computers. Obviously the amount of financial harm that could be caused by using that data is huge if fast and timely action had not been taken.

“ZeuS poses a threat to the use of the internet globally and is used by cyber criminals worldwide.”

Computer security experts described the family of ZeuS viruses as the biggest and most sophisticated “banking trojan” in the world, targeting the online banking accounts of millions of people.

Experts said that the virus had first emerged in 2007, but that in the past few months it had grown more resilient and sophisticated, able to find ways of avoiding detection by anti-virus software.

Orla Cox, an analyst from Symantec, the web security company, said that ZeuS had spread fast because a “toolkit” was available online that allowed would-be cybercriminals to customise and create their own versions.

“The toolkit makes it very easy for people to steal from online accounts,” she said. “It’s a nice piece of kit for any wannabe internet crime lord. It is easy to find on the web.”

She estimated that, in the past year alone, there had been up to 90,000 variations of the ZeuS virus that had infected computers.

The e-crime unit is liaising with international colleagues over the arrests and the threat the virus poses.

The man and woman were arrested on suspicion of offences under the Computer Misuse Act 1990 and the 2006 Fraud Act on November 3. They have been released on bail.

Businesses and individuals have reported being attacked around the world as money is secretly transferred from their accounts.

Criminals launder the money through complex banking networks and use the accounts of willing “money mules” to receive the money and withdraw it.

Detective Inspector Colin Wetherill of the e-crimes unit added: “The arrests represent a considerable breakthrough in our increasing efforts to combat online criminality.”

Times Recommends

• The Olympics: you need brass to go for gold
• The new must-have accessory: 3-D specs
• Does Dame Helen Mirren need a Face Lift?