[spydum]

Yes they can, but what we often see is accounts sold off to others. They don't give away their infected machine. They just harvest credentials.