Stealer Log Statistics 2026: Credential Theft at Scale

• Credential Theft at Scale: Flashpoint counted more than 11.1 million machines infected with infostealers in 2025 and 3.3 billion stolen credentials and cloud tokens. The first half of 2025 alone brought 1.8 billion credentials from 5.8 million infected hosts, 800% more than the previous six months, and the first half of 2026 brought another 7.4 million infected hosts (Flashpoint).
• Cybercrime Economy: Infostealers are rented as subscription Malware-as-a-Service, so cheap logs feed a large dark web resale market for credentials, cookies and network access.
• Ransomware Pipeline: 54% of ransomware victims disclosed in 2024 had their domains show up in infostealer logs or credential marketplace postings (Verizon DBIR 2025). In the 2026 DBIR, half of the ransomware victims that had a credential or infostealer event saw it within 95 days before the attack.
• Dominant Threat Vectors: Phishing was the leading intrusion vector (about 60%) in ENISA's EU incident data for July 2024 to June 2025, and IBM X-Force saw an 84% increase in emails delivering infostealers in 2024. Meanwhile, consent based attacks like fake browser updates (e.g. the ClickFix scam) trick users into running malware directly, bypassing exploits.
• Infostealer Malware Trends: The infostealer ecosystem is highly dynamic. After the takedown of RedLine, Lumma Stealer became the most prevalent infostealer of 2025, despite a Microsoft-led disruption in May 2025 that targeted about 2,300 malicious domains after 394,000 Windows computers were infected in two months. IBM X-Force (2026 Threat Intelligence Index) says Lumma held roughly 50% of observed infostealer activity in 2025, while Acreed and Rhadamanthys rose to about 16% and 11%; in H1 2026, Flashpoint's top families were Vidar, StealC and Lumma.
• Mac & Cross Platform Threats: Cybercriminals expanded into macOS: Banshee, a macOS-only stealer, launched with a $3,000 monthly subscription (Elastic, 2024). macOS infostealer incidents are still a niche, but they are growing as Apple devices are widely used by high value targets like developers and executives.
• Underground Markets & Pricing: Stealer logs are commodity goods: Russian Market has long priced individual logs at about $10. Logs with prime credentials (banking, corporate admin or cloud console access) sell for more, and initial access brokers charge far more again for validated network access with admin privileges.
• Industry Impacts: Healthcare and finance are top targets. Healthcare breaches remain the most expensive, at $6.64M per breach in IBM's 2026 data, and financial services averages $6.3M as threat actors chase banking and fintech credentials. Tech and manufacturing sectors also face frequent credential theft aimed at intellectual property and supply chain compromise.
• Regional Differences: The United States has the highest average breach cost ($10.22M in IBM's 2025 report, $11.5M in 2026), and the Middle East was second at $7.29M in 2025. Infection volumes are highest where software piracy is common and endpoint controls are weaker, while EU organizations face GDPR fines on top of breach costs.
• Multi Factor Authentication Under Fire: Infostealers routinely bypass MFA via session hijacking. SpyCloud's 2025 report counted 17.3 billion stolen session cookies recaptured from criminal sources. By replaying a stolen session cookie, attackers access accounts without needing passwords or MFA, rendering traditional OTP based MFA insufficient. Tech giants responded with measures like Chrome's App-Bound Encryption, but malware authors quickly adapted, continuing the cat and mouse game.
• AI & Automation in Attacks: 2025 saw threat actors embrace AI for offense from AI crafted phishing lures (over 82% of phishing emails now show some AI usage) to polymorphic malware code that evades antivirus. On the flip side, defenders increasingly deploy AI for detection, shaving time off breach response saving ~$1.9M for firms using security AI extensively. However, an AI oversight gap persists, as 63% of organizations lack AI governance policies, creating new shadow risks Shadow AI where rogue AI tools are used without security vetting.

In 2025 and 2026, stealer logs (packages of data harvested by infostealer malware) have become a linchpin of the cyber threat landscape. Stealer logs typically contain caches of login credentials, session cookies, browser history, saved credit cards, and other sensitive records siphoned from infected computers. While once a niche concern, these stolen data bundles are now driving the majority of cyberattacks, from account takeovers to full blown network breaches.

Why focus on stealer log statistics? The numbers tell a stark story: credentials are the new keys to the kingdom in cybersecurity. In the first half of 2025 alone, infostealers pilfered 1.8 billion credentials, and the full year brought 3.3 billion stolen credentials and cloud tokens, fueling an underground economy that trades access to organizations at scale. By examining breach costs, attack frequencies, top vectors, and industry impacts, we gain insight into how profoundly the industrialization of identity has altered the security landscape (see also our cybercrime statistics). Verizon's 2026 DBIR found that half of the ransomware victims with a credential or infostealer event saw it within 95 days before the attack, collapsing the timeline from initial compromise to extortion.

This report takes a data driven deep dive into Stealer Log Statistics for 2025 and 2026 examining how infostealers work, the scope of the threat in numbers, what it’s costing us, and which trends are emerging. We’ll explore metrics like the number of records and devices compromised, the surge in Malware-as-a-Service offerings, differences across regions and industries, and notable breaches that defined the year. The goal is to translate these statistics into actionable intelligence: understanding the enemy’s tactics in quantitative terms so that organizations can prioritize defenses accordingly.

What Are Stealer Log Statistics?

Stealer log statistics refer to the quantitative measures of credential stealing malware activity and its consequences. In simpler terms, if we think of a bank robbery, stealer logs are like the bags of loot credentials and data the thieves escape with and stealer log statistics track how many bags are stolen, how full they are, and what happens with them afterward. These stats can include the number of credentials stolen, the percentage of cyber incidents involving infostealer data, average prices for stolen logins on the black market, and so on. By analyzing these numbers, security professionals can gauge the scale and impact of infostealer threats.

For example, a stealer log might contain the saved passwords and cookies from an employee’s browser. One statistic might be the password reuse rate found in logs e.g. if 70% of stolen passwords are reused across multiple accounts, that indicates many users still practice poor password hygiene, amplifying the damage one stolen log can do. Another stat could be how many different malware families are contributing to the logs; if one infostealer variant, say LummaC2 accounts for 40% of all stolen logs observed in a year, that family becomes a priority for threat monitoring. Essentially, stealer log statistics shine a light on the who, what, and how often of credential theft.

To illustrate with an analogy: consider infostealer malware the vacuum cleaners of the cybercrime world, quietly sucking up data from countless computers. The stealer log statistics are like the vacuum’s dustbin that reports how much dirt was collected, from where, and how often it gets emptied and sold. In practical terms, these stats help organizations answer questions like: How many of our employee credentials might be floating around on the dark web? or What proportion of breaches in our industry involve stolen passwords? By quantifying the threat, defenders can better allocate resources e.g. enforcing password resets or rolling out MFA broadly to mitigate the risks indicated by the statistics.

Global Overview of Stealer Log Trends 2024–2026

Globally, infostealer activity has skyrocketed in both volume and impact over the past year. Table 1 provides a snapshot of key metrics from 2024 to 2026 so far, highlighting the trend:

Table 1: Global infostealer and breach trends, 2024–2026.

The table shows the scale of credential theft. Flashpoint counted 1.8 billion credentials stolen from 5.8 million infected hosts in the first half of 2025, 800% more than the previous six months, and more than 11.1 million infected machines over the full year. SpyCloud's 2026 report counts 65.7 billion distinct identity records recaptured from criminal sources, so the cumulative trove of stolen data is tens of billions of records and growing.

IBM's 2025 report showed the global average cost of a data breach dipping to $4.44 million from $4.88M in 2024, a 9% decrease attributed to faster detection and containment, before its 2026 report put it at a record $4.99 million. Averages also mask huge losses stemming from credential compromise: the United States and Middle East saw average breach costs of $10.22M and $7.29M in 2025, reflecting the heavier impact when high value targets are hit.

Crucially, stolen credentials have become entrenched in breaches worldwide. In Verizon's 2025 DBIR, the use of stolen credentials appeared in about 88% of breaches in the Basic Web Application Attacks pattern. In the 2026 DBIR, credential abuse fell to 13% as an initial access vector as vulnerability exploitation rose to 31%, but it still appeared at some stage of 39% of breaches. In essence, if you suffered a breach, chances are high that stolen credentials, possibly from a stealer log, played a role (see how many cyberattacks happen every day).

From a macro perspective, the cybercrime economy keeps growing alongside this trend, and credential data is one of its main currencies. That is also why insurers now ask about identity controls, MFA and testing before they price cyber insurance cover. Infostealer logs are the raw supply feeding that economy, whether sold in bulk on marketplaces or leveraged by criminals to drain bank accounts and deploy ransomware. The next sections break down how these costs accrue and how attacks are distributed across vectors, industries, and regions.

Cost Breakdown: Breach Costs vs. Underground Prices

Breaches are expensive and credentials theft is making them more so but there’s a stark contrast between what it costs a company vs. what it costs a hacker. Let’s examine the costs from both angles.

Direct Breach Costs to Organizations

According to IBM’s latest data, the average cost of a data breach in 2025 was $4.44 million globally. This was a slight improvement from the record $4.88M seen in 2024, and IBM's 2026 report then put the average at a new record of $4.99 million. Faster incident response helped by AI driven detection in some cases is credited for shaving off some costs. However, costs remain markedly higher for certain sectors and regions:

• Healthcare breaches are the costliest of any industry: $7.42 million in IBM's 2025 report and $6.64 million in 2026, still the highest of any industry. In the U.S., the average breach across all industries cost $10.22 million in 2025 and $11.5 million in 2026. These high figures reflect the sensitivity of medical data and the heavy fallout (fines, lawsuits, patient safety issues) when it is compromised.
• Financial services breaches also rank among the most expensive, at $6.3 million on average in IBM's 2026 report, driven by direct fraud losses and regulatory penalties. Infostealer logs containing banking, payment and fintech credentials are among the most valuable items in criminal markets.
• Critical infrastructure organizations (energy, telecom, etc.) face high breach costs as well, not only because of data loss but also because of disruption to operations (see our top cybersecurity threats overview).

Where do these costs come from? They encompass immediate expenses like forensic investigations, customer notifications, and system remediation, as well as longer term hits like business downtime, reputational damage, customer churn, and potential ransom payments or regulatory fines. One telling IBM statistic: breaches that take longer than 200 days to identify and contain cost $5.01M on average, significantly higher than those caught sooner. Unfortunately, infostealer related breaches often fall in the costly category because they involve silent infiltration attackers may lurk using stolen accounts for weeks or months before launching a disruptive attack, prolonging the detection timeline.

It’s also worth noting that breaches initiated via certain vectors have higher cost outcomes. IBM found phishing to be among the most expensive initial attack vectors, averaging $4.8M per breach. This aligns with credential theft scenarios; when an employee falls for a phish that delivers an infostealer, the adversary can quietly establish persistence e.g. via stolen VPN credentials or cloud tokens and maximize damage, leading to big cleanup costs down the line. By contrast, something like a lost device or an unexploited vulnerability might be contained faster or do limited damage, costing less.

Finally, regulatory fines are a growing cost factor. Data protection laws (GDPR in Europe, various state laws in the US, etc.) penalize organizations for preventable breaches. In IBM's 2025 report, about a third of breaches led to regulatory fines, and 48% of those fines exceeded $100,000. Breaches caused by stolen credentials can be seen as lapses in access management, something regulators expect companies to mitigate, for instance by using MFA or monitoring for compromised accounts.

Underground Market Prices for Stolen Data

On the flip side of the cost equation, let’s look at what attackers pay or earn for these stolen credentials. The economics of the dark web show a troubling imbalance: it is cheap for criminals to buy access, even while it’s very costly for victims when that access is abused. Table 2 highlights reported prices for stealer logs and network access in underground markets:

Table 2: Reported underground prices for stealer logs and network access (Flare; Rapid7 2025 Access Brokers Report).

From the above, a few insights emerge:

• Infostealer logs are dirt cheap in the grand scheme. At roughly $10 apiece on Russian Market, one of the largest log marketplaces, a criminal can, for the price of a movie ticket, buy a package that might contain passwords to dozens of websites, a handful of session cookies, autofill data addresses, credit cards, and more. This low cost is fueled by oversupply with millions of logs available, sellers compete on price and automate the sales. It’s sobering to realize that a company’s network could be breached through a $10 purchase if an employee’s VPN password is sitting in one of those logs.
• Premium access commands premium prices. When logs are filtered for specific high value access say, domain admin credentials or a Cloud provider console login the price shoots up. Initial Access Brokers will take a $10 log, validate the access, and resell it for hundreds or thousands. For instance, a package of working RDP credentials into a company, plus an Active Directory admin account, might go for $3,000 on a forum and that’s still a bargain compared to the potential ransom payout by the victim. Rapid7’s research noted 71% of access listings include some level of privilege granted, meaning the seller has done the legwork to enumerate what they’re selling.
• Bulk data vs. curated data: Some threat actors prefer buying in bulk e.g. a monthly Telegram feed of every log coming out of a botnet useful for those launching broad credential stuffing attacks or spam campaigns. Others will pay a premium for curated credentials e.g. I want an Office 365 admin login for a Fortune 500 company. The market caters to both, with bulk subscription models and retail stores with search filters. Notably, the Russian Market platform allows searching logs by domain keywords, so a buyer can find, for example, all logs containing @targetcompany.com credentials.
• Stolen session cookies and tokens also factor into pricing. While not shown as a separate line item above, a log containing a fresh cloud admin session token that bypasses MFA is extremely valuable. Some marketplaces now highlight logs with desirable cookies like a valid Okta session or VPN session and charge extra, or those logs get quickly snatched up by brokers.

In summary, attackers have a low cost of entry, whereas victims face high cost of damage. An infostealer malware kit can be rented for a few hundred dollars, and individual logs for a few bucks, yet the breaches enabled by these can cost organizations millions. This imbalance is a driving force behind the proliferation of stealer logs: the return on investment for cybercriminals is enormous.

Attack Vector Distribution (2025–2026 Data)

Understanding how attacks are happening is key to interpreting the statistics. In 2025, the leading initial access vector for breaches and security incidents depended on the dataset: phishing and credential abuse lead in some datasets, exploitation in others, with other vectors playing supporting roles. Table 3 breaks down the approximate distribution of attack vectors and their associated breach costs:

Table 3: Distribution of initial attack vectors in 2025 breaches, with estimated prevalence and impact.

From the above, phishing remained the leading entry point in European incident data: ENISA's 2025 analysis identified phishing (including email, phone, and malicious advertising) as the top initial access method at about 60%, far ahead of vulnerability exploitation at 21.3%. Phishing breaches are costly because they often lead to extensive compromise: attackers gain user credentials, move laterally, and potentially deploy ransomware (see our compromised credential statistics).

Stolen credentials deserve special mention. In many cases, phishing and stolen creds go hand in hand. In Verizon's 2025 DBIR, use of stolen credentials appeared in about 88% of basic web application attacks, and in the 2026 DBIR, credential abuse appeared at some stage of 39% of breaches, reinforcing that even if phishing wasn't the first vector, attackers eventually lean on some credential to escalate access. A common scenario is a breach chain: attacker phishes one employee, implants an infostealer, steals a bunch of passwords, then uses one of those passwords to log in as an administrator. The initial vector was phishing, but the pivotal action was using stolen credentials (see compromised credential statistics).

Exploitation is not a minor vector. Verizon's 2026 DBIR found vulnerability exploitation was the most common known initial access vector (31%), and Mandiant's M-Trends 2026 ranked exploits first (32%) for the sixth year, while ENISA's EU data put phishing first (about 60%). Credential abuse often appears later in the attack even when it was not the entry point. When exploits do lead to a breach, the impact can be severe, think SolarWinds 2020 or the Log4j exploitation waves. One example in 2025 was a zero day exploit in a popular file sharing app that allowed attackers to drop malware into enterprises but even that often required a stolen access token to trigger in the first place. It’s increasingly common that exploits serve to augment credential attacks e.g. use stolen creds to get in, then exploit a privilege escalation bug to get admin rights.

Insider threats constitute a smaller slice of the pie, a few percent, but with notably high costs when they happen. IBM has previously noted insider caused breaches can cost more than the average, as the betrayal of trust often leads to significant data loss before detection. In 2025, a handful of breaches involved employees intentionally planting malware or selling their passwords. These are hard to defend against with technology alone, requiring governance and monitoring of user behavior.

Emerging vectors like AI related issues didn’t yet significantly register in breach statistics, but they are on the radar. Shadow AI refers to the unsanctioned use of AI tools by employees for instance, using an online AI service and inadvertently feeding it sensitive data that could be exposed. There were minor incidents of proprietary code or credentials leaking via public AI query logs this year. Additionally, threat actors leveraging AI to automate attacks like deepfake phone calls as part of phishing, or AI written malware that morphs its signature made qualitative impacts even if not a separate statistical category. The consensus in threat intel circles is that these AI fueled techniques often still lead to the same end result: stolen credentials or unauthorized access essentially amplifying the primary vectors rather than introducing completely new ones.

In summary, the statistics underscore that human facing attacks (phishing and identity abuse with stolen creds) and vulnerability exploitation dominate the threat landscape in 2025: phishing and credential abuse lead in some datasets, exploitation in others. This means organizations need to double down on user awareness, phishing resistant authentication, and monitoring of login activity, while keeping exposed systems patched, as those directly address the top vectors by the numbers.

Industry Breakdown: Who’s Being Hit and How

Different industries experience the effects of stealer logs and data breaches in distinct ways. Here’s a breakdown of how key sectors fared in 2025, including both the volume of incidents and the cost/impact on each:

• Healthcare: The healthcare sector continues to be in the crosshairs of attackers and unfortunately, when it is hit, it pays the highest price. In 2025, healthcare organizations suffered a steady barrage of infostealer infiltrations. Why? Hospitals and providers have extensive IT systems and often less robust security, making them fertile ground for credential stealing malware e.g. an employee unknowingly installs an infostealer on a hospital workstation, compromising patient record system logins. The average cost of a healthcare breach reached $7.42M globally, more than 1.5× the overall average. Particularly alarming is the ransomware trend: many ransomware gangs target healthcare after obtaining credentials, knowing that the urgency to restore systems for patient safety might force victims to pay. As a hypothetical illustration, a hospital chain’s staff credentials could be on sale in underground markets before a ransomware attack, a classic stealer log pipeline scenario. Another stat: healthcare breaches take longest to identify and contain avg. ~10 months, which inflates costs further. Implication: Healthcare must invest in identity security MFA, zero trust and network segmentation to limit the fallout of stolen credentials.
• Finance Banking & Insurance: Financial firms are a prime target for infostealers, from malware directly targeting banking credentials to stealers used to penetrate fintech and crypto platforms (see our malware statistics). The motive is clear: money. Cybercriminals deploy stealers to harvest login cookies for online banking, cryptocurrency wallets and trading accounts. Financial services breaches averaged $6.3 million in IBM's 2026 report. Initial access brokers also specialize in selling access to finance companies, often traced back to stealer logs. Implication: financial organizations should assume some employee or customer credentials are already compromised and layer controls accordingly (transaction monitoring, device authentication, etc.).
• Technology Tech Companies & SaaS Providers: Tech companies are both targets and inadvertent vectors. In 2025, several tech firms suffered breaches due to infostealers hitting their employees or contractors. For example, the Okta support system breach late 2023 involved an employee’s stolen credential and session token, allowing attackers to access enterprise clients’ data. Tech companies also have valuable single sign on and identity infrastructure if those are breached, it cascades to customers as seen with Okta. Beyond direct breach costs, the bigger risk is intellectual property theft and supply chain impact. Attackers love targeting software firms to indirectly compromise downstream clients e.g. by stealing code signing certificates or injecting backdoors into updates. Implication: Tech firms need to secure their development and support environments heavily. Practices like requiring hardware security keys, phishing resistant MFA for all staff, monitoring code repository access, and isolating build systems are critical to stop stealer log enabled intrusions.
• Manufacturing & Industrial: Manufacturers historically dealt more with ransomware taking down factories and IP theft. Stealer logs are now a key route in, often because of less controlled networks and BYOD devices: Verizon's 2025 DBIR found 30% of compromised systems in infostealer data were enterprise-licensed devices. One common scenario: an engineer logs into a production system from an unsecured home PC infected with an infostealer; the credentials are stolen and sold, and a ransomware group later uses them to break in and halt production. Implication: manufacturing must incorporate stronger network segmentation and require that even third party access uses MFA and is monitored.
• Retail & E commerce: Retailers have been hit hard by infostealers in terms of customer account takeover and card theft. Stealers are often spread through fake coupon sites or game cracks that appeal to consumers, so many consumer credentials end up in logs. In October 2025, Have I Been Pwned added 183 million accounts compiled from infostealer logs and credential stuffing lists, many of which can be reused against e-commerce sites. Retail companies also suffer admin panel breaches when employee accounts are compromised. Retailers have responded by increasing customer MFA and bot detection, but the sheer volume of leaked credentials makes it a whack a mole situation.
• Government & Public Sector: Government agencies worldwide saw numerous incidents of credential theft as well. Everything from local municipalities to national agencies had employees fall victim to phishing or malware, leading to breaches of email systems, citizen data, etc. Notably, state aligned hacker groups continue to leverage stealer logs as a source of initial access for espionage. For instance, an APT advanced persistent threat actor might sift through stolen logs for any that belong to government domains like .gov emails and then use those to infiltrate. In 2025, there were instances of nation state attackers using infostealer obtained credentials to quietly access diplomats’ email accounts. The public sector also has the challenge of legacy systems some old government servers had credentials that were stolen and floating around for years. The costs for public sector breaches are harder to quantify often it’s loss of public trust or national security risk rather than direct financial cost, since records like PII might not have immediate monetary loss yet potentially high impact in other ways. Also, regulatory fines often don’t apply to governments themselves, but they face political fallout. Implication: Governments are trying to implement zero trust architectures, assuming that credentials may be compromised and requiring continuous verification. However, budget and legacy tech issues persist, making this sector a slow mover despite high stakes.

Across all industries, a unifying theme from these statistics is the importance of identity security. Nearly every sector’s major incidents traced back to someone’s account getting compromised whether through an infostealer or phishing and then attackers exploiting that trust. Industries with strict regulations in finance, healthcare tend to invest more in security yet still struggle due to the human factor. Less regulated industries manufacturing, small retail often underinvest and are now catching up after some wake up calls in 2025.

Regional Breakdown: Global vs. Regional Impacts

While the infostealer and credential theft epidemic is global, there are regional nuances in both prevalence and consequences:

• U.S. organizations can use penetration testing to check whether exposed credentials still grant access. The U.S. remains a prime target and source of stealer logs, making identity validation, exposed-session review, and access-path testing critical controls. The impact is also highest: the average breach cost in the U.S. was $10.22M in 2025 and $11.5M in IBM's 2026 data, more than double the global average. U.S. companies often store large volumes of data, attract ransomware due to deeper pockets, and face an expensive legal environment after breaches. The MGM Resorts breach, which MGM estimated cost about $100M, showed how identity attacks can hit a U.S. company. State laws like California's CCPA/CPRA also enforce penalties for leaked personal data.
• UK organizations can use penetration testing to check whether exposed credentials still grant access. Europe and the UK have experienced high volumes of credential-related attacks, while GDPR and privacy obligations increase the pressure to detect, validate, and remediate exposed access quickly. For instance, British Airways was fined millions of euros in prior years for a breach and that has set a precedent. The threat stats show that European entities are as targeted as ever; the UK, Germany, and France often appear in the top countries for high value logs being traded due to their wealth. ENISA’s Threat Landscape 2025 noted an increase in attacks on critical sectors like public administration and transportation in the EU, many starting with phishing or stolen VPN logins. However, European companies on average have slightly lower breach costs ~$3.75M average than U.S. companies, perhaps due to quicker regulatory driven responses and possibly less litigation cost. Also, there’s a bit more uniform adoption of security standards in some EU industries due to laws like NIS2 which mandates certain cybersecurity measures for essential services.
• Middle East & Africa MEA: The Middle East had the most expensive breaches outside the U.S. in IBM's 2025 report, averaging $7.29M per breach. Wealthy Gulf region organizations and critical oil & gas infrastructure are prime targets for both financially motivated groups and nation state actors. Personal devices are a major risk factor everywhere: Verizon's 2025 DBIR found 46% of compromised systems with corporate logins were non-managed and held both personal and business credentials. Certain MEA banks have pioneered advanced authentication like biometrics and physical tokens, which help mitigate credential abuse, while emerging African economies with growing internet use and weaker cybersecurity infrastructure see high infection volumes.
• Asia Pacific APAC: APAC is a mixed bag given its diversity. Tech forward nations like Japan, South Korea, Singapore, and Australia have strong cybersecurity programs but still face relentless attacks, while large developing markets contribute big shares of infostealer-infected machines because of population size, rapid digitization and software piracy. Many new internet users may not be trained on security, leading to high success for phishing and malicious Android apps that steal credentials. State sponsored groups in the region also use stolen credentials to gain initial footholds for espionage rather than ransom.

In all regions, a theme emerges: no region is untouched by infostealer driven breaches. However, local factors, regulations, typical security maturity, and economic conditions influence how severe the outcomes are. For instance, Europe’s heavy fines push better data handling, the U.S.’s lucrative market attracts more targeted ransomware extortion, and APAC’s rapid growth + occasionally lax controls create many opportunities for infections.

It’s also worth noting cross regional dynamics: A stealer log collected in Brazil might end up being used by a Russian hacker to break into a U.S. company geography is no barrier in the underground marketplace. Yet statistics like Brazil (about 9.5%) and India (about 7.9%) in SOCRadar's October 2025 victim-country breakdown show where attackers may be casting wide nets. Often those high percentage countries coincide with widespread software piracy fake cracks carrying infostealers and less endpoint protection, which is why they appear heavily in logs.

Major Breaches of 2025: Case Studies

The year 2025 saw several notable cyber incidents where stealer logs or stolen credentials played a central role. Below, we summarize a few major breaches that highlight the trends discussed:

1. Telefónica Breach 2025, Hellcat via Infostealer-Stolen Logins: In January 2025, the Hellcat group breached Spanish telecom giant Telefónica's internal Jira ticketing system. Hudson Rock reported that private infostealer malware was used to compromise the credentials of more than 15 employees, which the attackers combined with social engineering to get in, and that 531 Telefónica employee computers had been infected by infostealers in 2024. The case underlined how infostealer infections on employee or contractor machines can hand attackers valid logins to internal systems, even at well secured enterprises.
2. Samsung Germany Ticket System Leak 2025 Dormant Credentials Resurface: In March 2025, a hacker known as GHNA leaked 270,000 customer support tickets from Samsung Germany’s systems. Interestingly, this breach traced back not to a fresh attack but to a long dormant credential compromise from 2021. Back in 2021, an employee at a third party vendor Spectos GmbH, which managed Samsung’s support portal, had been infected with Raccoon Stealer malware. The employee’s credentials for the Samsung support site were stolen and apparently lay unnoticed on a dark web forum. Years later, GHNA found or bought those credentials and used them to log into Samsung’s support database, extracting hundreds of thousands of customer records. The incident highlights the long tail of stealer logs: even old stolen logins can come back to bite if not proactively invalidated. It also demonstrated a classic supply chain breach. Samsung itself wasn’t hacked initially it was their contractor’s weak link via an infostealer, which eventually led to Samsung’s data being exposed. After this, Samsung and many companies began enforcing stricter password rotation and zero trust access for vendors.
3. MGM Resorts and Caesars Entertainment 2023 Okta Identity System Compromise: While late 2023, the twin breaches of MGM Resorts and Caesars carried over lessons into 2024 2025. These were orchestrated by the Scattered Spider group linked to ALPHV/BlackCat ransomware and involved deep social engineering. The attackers obtained helpdesk credentials through phone based social engineering, not exactly a stealer log, but akin to it and then pivoted to steal session cookies and passwords from Okta the identity provider to escalate privileges. Once inside, they bypassed MFA and had free reign, leading to a shutdown of MGM’s casinos and systems, and a rumored ransom payout by Caesars. Why this matters for 2025: it showed even identity platforms aren’t immune Okta itself warned that stolen session tokens were used against it. Many companies re-examined how they handle session cookies after seeing this. It underlined that credentials and tokens are a common thread from simple infostealer attacks to big game ransomware attacks. Subsequent data showed 54% of ransomware victims’ domains were in stealer logs pre attack, which means what happened to MGM/Caesars credentials >ransomware was not an outlier but part of a growing pattern.
4. CircleCI Breach 2023 Developer’s Infostealer Infection: Another instructive case disclosed January 2023 was CircleCI, a popular DevOps platform, getting breached because a developer’s laptop was infected with token stealing malware. The infostealer lifted a 2FA backed SSO session cookie, letting the attacker impersonate the developer without needing MFA. They then generated production access tokens, stealing secrets and customer data. This incident was one of the first high profile ones to explicitly implicate infostealer malware as the root cause in a software supply chain context. In 2025, many DevOps and cloud companies took note and ramped up endpoint security for engineers like requiring EDR on any device that can access production, strict token scopes, etc.. The CircleCI case proved that just one compromised developer PC can lead to a breach of thousands of customers’ data, exemplifying how infostealers can create single points of failure in a highly connected environment.
5. Hawklog Cloud Breach 2024 Early in 2024, an interesting twist occurred: hackers themselves got hacked. Hawklog, a private Telegram based log shop cloud service selling logs, was breached by a rival group Mooncloud. Mooncloud leaked 1.7 GB of data from Hawklog, which included email addresses and stolen logs that Hawklog was selling (SOCRadar, May 2024). This meta breach didn’t directly hurt end user organizations, it wasn't their breach data, it was criminals stealing from criminals, but it showed how much log data circulates in these channels. The incident also highlighted the volatile nature of the underground: even cybercriminals worry about their databases getting breached. For defenders, such leaks are a double edged sword they expose more stolen data bad but also give a chance to identify and respond to compromises good if acted upon quickly.

Each of these cases reinforced a key lesson: stealer logs and stolen credentials are at the heart of modern breaches. Whether it’s ransomware, data theft, or supply chain attacks, the initial vector or the critical stepping stone often comes down to a username and password or token that the attacker should never have had. By examining breaches, organizations realized in 2025 that traditional perimeter defenses, firewalls, etc. matter less if an attacker can simply log in with valid credentials. It’s like locking your doors but giving the thief a copy of the key.

Emerging Trends in the Credential Threat Landscape

Looking forward beyond 2025, several emerging trends are poised to shape the infostealer and credential theft landscape. These trends are rooted in observations from late 2024 through 2025, and understanding them can help organizations brace for what’s next:

• Convergence of Attack Tools Stealers, RATs, and Ransomware: The once distinct categories of malware are blurring. Infostealers are no longer just about stealing data, many are adding capabilities to persist in systems and even act as backdoors. Conversely, some remote access trojans RATs now include credential stealing modules. The trend is toward Swiss Army knife malware. For example, Vidar, historically an infostealer, implemented features like downloading secondary payloads essentially acting as a loader. Likewise, emerging stealers like Acreed launched in 2025 with both data theft and stealthy injection techniques to evade EDR. What this means is an attack may start with an infostealer, but then transition seamlessly to hands on keyboard control or to deploying ransomware, without needing a separate tool. We expect 2026 to bring more multifunction Malware-as-a-Service offerings, essentially one stop shops where an affiliate can gain entry steal creds and also deploy whatever payload they want post theft, all using the same malware binary. This complicates detection because the lines between just a credential theft and full compromise will blur. Defenders must treat any malware on an endpoint as potential full intrusion now, not just a minor data leak.
• Rise of macOS and Mobile Infostealers: As mentioned, Banshee, a macOS focused stealer first documented in 2024, drew notable attention. Historically, infostealers overwhelmingly targeted Windows, as it’s more common in enterprise. But trends show macOS devices especially among developers, executives, and journalists are lucrative targets they often contain sensitive cloud credentials, SSH keys, etc.. Banshee proved that criminals are willing to invest in Mac malware development. A 2025 variant reused the string-encryption algorithm from Apple’s own XProtect to evade detection. We anticipate more macOS Malware-as-a-Service offerings in 2026, possibly a Lumma for Mac. On the mobile front, while less reported in 2025, Android infostealers malicious apps that steal SMS 2FA codes, password manager entries, etc. continue to evolve. There was an uptick in Telegram bot based stealers that target session cookies in mobile browsers and messaging app tokens. Given how many people use phones for MFA, attackers are keen to get into those as well. Organizations can no longer assume our Macs and mobile devices are safe. Cross platform credential theft is an emerging reality one that requires expanding endpoint protections and user education to those devices too.
• Generative AI for Offense and Defense: AI’s role in cybersecurity grew dramatically. On offense, 2025 saw proof that attackers are using Generative AI to produce highly tailored phishing content at scale. We noted earlier that 82.6% of phishing emails showed signs of AI usage e.g. perfectly fluent language, even style mimicking. AI can also generate malicious code snippets that mutate, helping infostealers become more polymorphic, changing form to evade detection. We even saw concept of AI driven malware that can adapt its C2 communication patterns on the fly though mostly theoretical so far. On defense, AI has been a double edged sword: when used, it helped drop breach costs by accelerating detection. IBM noted companies using AI extensively saved ~$1.9M in breach costs. But adoption of defensive AI is uneven, and lack of AI governance is itself a risk. With 63% of organizations lacking AI governance policies, an AI system could potentially leak data or be manipulated. A specific trend to watch: AI powered phishing kits that can conduct conversational phishing where an AI chatbot pretends to be IT support and tricks employees into revealing credentials in real time. These were in nascent stages in 2025 but will likely grow. Conversely, expect to see AI in email security filters working to detect the subtle signs of AI written messages.
• Shadow AI and Data Leakage: As organizations lock down official channels, employees sometimes turn to third party AI or cloud tools to get work done, not realizing the risk. For example, a coder might paste company code into ChatGPT to debug it inadvertently exposing proprietary logic. Or an analyst might use a free cloud converter service to handle a sensitive CSV file, not knowing it stores uploads. These unsanctioned IT/AI uses Shadow AI create new leakage vectors that bypass traditional DLP data loss prevention. As a hypothetical illustration, a company could find its internal meeting notes exposed after an employee fed them to an external transcription AI service. Credentials too could leak: imagine someone pasting error logs with embedded passwords or keys into an AI forum. While not as malicious as a hacker, the effect is similar data winds up where it shouldn’t. Companies started addressing this in 2025 by restricting access to external AI or by deploying on premises AI solutions that don’t leak data. This will be a growing area: balancing AI productivity gains with security. We might see AI usage policies becoming as standard as internet acceptable use policies.
• Browser and Cloud Session Hardening: To combat the deluge of stolen cookies and tokens, vendors are evolving protection. Google added App-Bound Encryption to Chrome on Windows in 2024; infostealers bypassed it within weeks, though it at least raised the bar slightly. Its newer Device Bound Session Credentials (DBSC) bind sessions to a device key so stolen cookies fail elsewhere. We expect browsers to experiment more with ephemeral credentials or more frequent invalidation. Also, cloud services might shorten session lifetimes or implement risk based re authentication for instance, if a login session cookie is used from a new location, require re login. Microsoft, Google, Okta and others are keenly aware that session hijacking is undermining MFA, so an emerging trend is phishing resistant MFA: methods like FIDO2 security keys or platform biometrics that can’t be stolen via software alone. Already, some companies in 2025 moved to WebAuthn which is immune to replay attacks for VPN and admin access. The stats on cookie theft billions stolen have spurred these defensive changes. We foresee that by 2026 more cloud providers will offer private access tokens that are bound to device identity in addition to user identity meaning a stolen token from one machine won’t work on another. It’s an arms race for sure, but necessary to tilt the game away from the attackers’ current advantage with logs.
• Initial Access Broker Ecosystem Maturing: The role of IABs Initial Access Brokers in monetizing stealer logs became very clear in 2025. They act as middle men who purchase raw logs, filter and validate them, then sell network access. This specialization means that even unsophisticated ransomware groups can just buy their way in. One trend is the professionalization of IAB operations some IABs provide customer support to buyers, multi tier pricing, cheaper access vs. exclusive access, and even subscriptions for recurring access to certain networks. If this continues, we might see a sort of criminal access as a service where, for a hefty fee, a broker guarantees access to a target organization and even offers a replacement or refund if the credentials get reset. The marketplace dynamics we saw deposits required to weed out LE, user reviews on Russian Market, etc. will likely refine further. The flipside is law enforcement is also focusing on IABs, since they’re chokepoints in the ransomware supply chain. Law enforcement has hit these chokepoints before: Operation Cookie Monster took down Genesis Market in April 2023, and Operation Magnus disrupted the RedLine and META infostealers in October 2024. The trend in 2025/26 could be more takedowns of marketplaces but as we’ve seen, the ecosystem often just shifts. Russian Market took in refugees from Genesis, Telegram clouds proliferated when forums shut down. In any case, companies should watch these developments: if IABs get disrupted, threat actors might revert to more direct phishing; if IABs flourish, then monitoring their marketplaces for your domain mentions via threat intel becomes even more critical.
• Quantum and Post Quantum Concerns Beyond 2025: While more futuristic, some forward looking security teams are pondering the effect of quantum computing on encryption. If quantum computing advances, it could potentially crack certain encryption that protects password databases or allow impersonation by breaking public key schemes used in MFA. This is not an immediate threat, but it’s on the horizon. NIST has been standardizing post quantum cryptographic algorithms. For our context, one area is password hashing companies might need to move to quantum resistant hashing for stored passwords in case an attacker in a decade could retroactively crack stolen password hashes. It’s a bit theoretical, but worth noting as an emerging consideration: the credentials we secure today should ideally remain secure even if attackers get quantum capabilities tomorrow. Some organizations have started inventorying where they use cryptography that might need upgrades though this is still niche in 2025.

In summary, the emerging trends revolve around evolution on both sides, attackers integrating tools and using new tech, and defenders pushing toward a more identity centric, phishing proof paradigm. The statistics we’ve observed in 2025 are likely to continue credential theft being paramount unless these emerging defensive strategies change the game. For instance, if in a few years a majority of organizations adopt FIDO2 MFA and robust session management, we might finally see that 88% share of stolen credentials in basic web application breaches go down. Until then, the trajectory is that thieves will keep doing what works, stealing logins, and thus everything from malware design to dark web operations will continue to revolve around that valuable commodity our identities.

What These Statistics Mean: Interpreting the Big Picture

All the numbers and percentages we’ve discussed paint a clear picture: the battleground has shifted to identities and credentials. To put it bluntly, it’s no longer primarily an age of smash and grab hacks or sophisticated exploits, it's an age of silent identity compromise. The statistics drive home several strategic implications:

1. Identity is the New Perimeter: With 88% of basic web application attacks involving stolen credentials (Verizon DBIR 2025), it means that an organization’s user accounts are effectively the front door for attackers. The old paradigm of securing the network perimeter firewalls, VPN concentrators, etc. matters less if an attacker can simply log in as an authorized user. All the stolen log and infostealer stats underscore that your employees’ and customers’ logins are the prize. So perimeter security now means securing identity through strong authentication, monitoring logins, and least privilege access. The stats about BYOD devices 46% of compromised systems with corporate logins being non-managed devices also show that the perimeter is everywhere an identity can be used. Companies must assume that credentials will be stolen and design security such that a stolen credential alone isn’t enough for an attacker to succeed.
2. Time to Exploit is Shrinking: When over half of ransomware victims had their domains in infostealer logs or credential marketplaces before the attack, and half of those with a credential event saw it within 95 days of the attack (Verizon DBIR 2026), it tells us attackers move extremely fast. Automation is a factor they have tools to scan new stolen logs for juicy accounts and bots that attempt to use them immediately. The implication for defenders is that response time is critical. If you find out an employee’s password was in a leak or stealer log, you may have hours, not days before that leads to an incident. The importance of continuous threat intelligence monitoring and rapid incident response like automatically invalidating credentials found leaked cannot be overstated. Essentially, security teams need to operate at machine speed because the attackers’ exploitation cycle is largely automated now.
3. The Economics Favor Attackers for now: The cost asymmetry we highlighted $10 stolen log vs $4 million breach means attackers have a huge ROI. This unfortunately incentivizes more cybercriminals to get into the game. We even see geopolitical drivers, like talented developers in sanction hit regions turning to cybercrime as a lucrative alternative. Until we flip that script, this problem will get worse. Flipping the script might mean increasing attacker costs through more aggressive law enforcement, or by deploying controls that make each attack less likely to succeed, forcing them to invest more. But currently, given the growth in infected devices and stolen logs, the underground economy is robust and resilient to takedowns. Organizations should interpret these numbers as a sign that purely reactive security cleaning up after breaches is financially unsustainable. Investing in preventive measures even if they are costly upfront is justified when you compare to the multi million dollar hit of a breach.
4. MFA Is Necessary But Not Sufficient: Many companies rolled out multi factor authentication MFA in recent years, which is good but the stats about session hijacking and MFA bypass 17.3 billion cookies recaptured by SpyCloud, etc. show that traditional MFA SMS codes, authenticator apps can be sidestepped. Attackers don’t need to hack MFA if they can simply use a session token stolen from an authenticated session. So the meaning here is that yes, MFA significantly reduces risk. Remember, without MFA, a stolen password is immediate game over; with MFA at least there’s an extra step, but it’s not a panacea. Organizations must combine MFA with other measures: things like device trust checks only allowing logins from managed devices, anomaly detection flagging if a session cookie that originated in one country is being used in another, and shorter session durations. The advent of phishing resistant MFA like FIDO2 keys is a promising answer to infostealers. These keys are designed such that even if malware steals something, it can’t reuse it elsewhere. The stats are basically screaming that the era of password based security is over, passwords alone will fail, and even passwords + SMS codes are struggling. It’s time to accelerate the adoption of passwordless auth and hardware backed keys which significantly narrow the window for attackers.
5. User Awareness and Training Need a Refresh: Phishing still leading at about 60% of EU intrusions (ENISA) and the explosion of AI crafted lures mean we need to up our game in security awareness. Traditional training look for typos, bad grammar, unfamiliar senders is less effective when phishing emails are now polished and personalized thanks to AI and massive data leaks that inform social engineering. The statistics show employees are still falling victim evidenced by how infostealers spread someone had to run that malware, often believing it was something benign. Companies should interpret that as a need to both use technology email filtering, safe browsing tools and creative training simulated phishing exercises that now include AI voiced phone scams, etc.. The human element was a factor in 60% of breaches as per Verizon's 2025 DBIR (62% in 2026). That hasn’t budged much year over year meaning our approach to the human factor must evolve. Emphasize the concept of trust but verify for any unsolicited request, and perhaps lean into fostering a culture where employees aren’t afraid to double check an email via a secondary channel before clicking a link or entering credentials.
6. Incident Response Must Assume Stealthy Pre Breach: Several of the case studies Telefónica, etc. showed attackers lurking and gathering data long before detonating an attack. Infostealer infections by design are stealthy they don’t announce themselves like ransomware does. So an implication is that companies should boost their threat hunting and assume that even without alerts, an intrusion might be underway via a stolen account. The average dwell time time from intrusion to detection for credential based breaches can be quite long the global median was on the order of months in many reports. Verizon's 2026 DBIR finding that half of the ransomware victims with a credential or infostealer event saw it within 95 days before the attack suggests there were missed opportunities to catch the precursor. If an EDR detects an infostealer malware on a machine and that machine had any corporate logins, treat it as a major incident not just cleaning malware, but investigating lateral movement, password changes, etc. Basically, shift mentality from oh malware on Bob’s PC, reimage it to Bob’s credentials and perhaps others are compromised, initiate full incident response.
7. Collaborative Security Internal and External: The breadth of this threat hitting all industries, and with initial access often coming via third parties or employees’ personal practices means silos in security are dangerous. Internally, IT, security, identity management, and even HR for training have to collaborate closely. Externally, sharing threat intel within industry groups like ISACs about infostealer campaigns or leaked credentials can be hugely beneficial. The statistics are industry agnostic in many ways: everyone’s getting hit. So it’s a rising tide scenario where sharing knowledge doesn’t usually harm competitive advantage, but does raise collective defenses. For example, if one company sees a surge of phishing with a new malware strain, informing peers could prevent that strain from stealing thousands more creds elsewhere which in turn reduces the overall pool of stolen logs on sale. Some sectors started doing this more in 2025 financial services ISAC issued alerts about specific infostealer indicators, etc.. This collaborative approach is a needed response implied by the scale: no single entity can tackle a flood of billions of stolen creds alone.

In essence, these statistics mean we have to rethink traditional cybersecurity priorities. Firewalls and endpoint antivirus alone aren’t stopping these trends. Identity centric security, proactive threat intel, user focused safeguards, and speedy response are the key takeaways. It’s also a call to arms that security investments should tilt towards where the data shows the problems are: if 60% of attacks in ENISA’s EU data start with phishing, then significant budget and effort should be going into email security, phishing drills, and robust authentication, without neglecting patching and vulnerability management: phishing and credential abuse lead in some datasets, exploitation in others.

The numbers validate that attackers prefer the path of least resistance, which is often an unsuspecting user or an exposed credential. Organizations must respond by hardening identities and educating users to raise that resistance. Until hardening identities and educating users happens broadly, we should expect the number of stolen logs and ransomware incidents originating from those logs to continue rising. A professional red-team engagement can validate whether exposed credentials still enable initial access, privilege escalation, lateral movement, persistence, or data exfiltration across realistic attack paths.

Best Practices for Defense 2026 and Beyond

Given the statistical evidence of how threats are evolving, here are actionable best practices organizations should implement to counter the stealer log and credential theft epidemic:

1. Implementing Phishing Resistant Multi Factor Authentication MFA: Traditional MFA like SMS codes or mobile app prompts is better than nothing, but as we’ve seen, sophisticated attackers can bypass it via cookie theft or real time phishing proxies. The best current defense is to move to phishing resistant MFA such as FIDO2/WebAuthn security keys or biometrics. These methods use cryptographic exchanges tied to the website, so even if a user is tricked, the attacker cannot reuse the authentication on a different device or site. Many tech giants and governments are now mandating security keys for privileged users. Start with high risk accounts, admins, remote access users and expand out. Also consider number matching and push MFA enhancements if using phone apps to thwart push spam attacks. By eliminating easily phishable factors, you cut off a prime way infostealers and phishers get in. Goal: Even if a password is stolen, it’s not enough to breach the account.
2. Shorten Session Lifetimes & Monitor Sessions: As stats showed, one big gap is long lived sessions cookies, tokens that attackers exploit. Adjust your authentication systems so that session tokens expire more frequently, for instance, require re login after 8 or 12 hours of inactivity rather than multi-day or multi week sessions. Yes, it inconveniences users a bit, but it limits the window an attacker can reuse a stolen cookie. Additionally, implement session management controls: kill all active sessions during a password reset, routinely invalidate tokens when certain conditions change like IP address shifts, and provide users and admins with visibility to terminate suspicious sessions. Some organizations now force critical applications VPNs, finance systems to not allow users to remember me for 30 days' logins precisely because if those tokens leak, the attacker has a month of access. Coupled with that, invest in user behavior analytics that can detect anomalies like an account that usually logs in from New York suddenly using a token from Moscow and immediately flag or block it. Reducing session lifetime means a stolen log from last week is less likely to still work today, thereby cutting down the exploitation of logs at scale.
3. Zero Trust Approach Never Trust, Always Verify: Embrace a Zero Trust security model where no user or device is inherently trusted, even if already inside the network. Practically, this means requiring authentication and authorization checks at every important boundary. For example, even if a VPN connection is established, you might re prompt for MFA when accessing a critical database. Use network segmentation and micro segmentation such that credentials for one system don’t automatically grant access to all. The aim is to limit what an attacker can do with any single stolen credential. If Bob from Marketing’s account gets popped, maybe they can access the marketing share, but not the finance database or the domain controller. Zero Trust also involves verifying device posture and only allows devices with up to date patches and security software to access sensitive resources through device certificates or agent checks. So if an attacker tries to use stolen creds from an unknown device, they hit a wall. Implementing Zero Trust is a journey not a flip of a switch, but starting with high value applications and VPNs is wise. Key idea: Assume breach and compartmentalize trust so that stealing one identity doesn’t grant an all access pass.
4. Continuous Dark Web Monitoring & Credential Screening: In light of the huge volume of stolen data circulating, organizations should leverage threat intelligence services that monitor dark web markets and data leaks for their domains and user accounts. For instance, subscribe to services or use open source intelligence that alert you if an email address at your company shows up in a credential dump or stealer log for sale. Some companies even set up honeytoken accounts to see if they surface on marketplaces. When you get an alert, act fast: force password resets for that user and anything else they had access to, check logs for any suspicious use of that account, etc. Additionally, implement credential screening on your authentication, this means comparing new user passwords or periodic checks against known breached password lists. NIST guidelines suggest forbidding passwords known to be compromised. Many single sign-on platforms now have an API to check if a user’s chosen password appears in the HaveIBeenPwned database or similar. This helps reduce the chance that a credential stuffing attack will succeed, since users won’t be allowed to use passwords that are already public. Essentially, don’t let known bad credentials stay in use within your org flush them out proactively.
5. Enhance Endpoint Security and EDR Coverage Including BYOD: Since infostealer malware is the initial vector in many cases, having strong endpoint defenses is crucial to catch it or prevent it. Deploy next gen antivirus or Endpoint Detection & Response EDR agents that specifically look for infostealer behaviors like processes accessing browser password stores, or abnormal file access patterns. Many EDR solutions in 2025 updated their rules to detect common stealers like Raccoon, RedLine, etc. Ensure these are rolled out to all corporate devices. For BYOD bring your own device, consider mobile device management MDM solutions or requiring that personal devices meet certain security standards if they’re going to be used for work. If feasible, provide secure virtual desktop environments for personal devices so that even if the personal OS is infected, it can’t directly snatch corporate passwords. Also, educate users on securing their personal devices e.g. avoid using the same browser profile for personal surfing and work access, since a stealer will grab all profiles. Some companies, noticing that 46% stat of unmanaged devices in leaks, have started subsidizing security software for home use or even providing thin client laptops for remote work instead of letting people use home PCs. The goal is to reduce the chances of an infostealer infection and to quickly quarantine it if it happens. A contained infostealer incident caught at initial infection is far better than one that quietly exfiltrates creds for months.
6. Robust Incident Response Plans Assume Credential Compromise: Update your incident response IR plans to specifically address scenarios of stolen credentials. This means having playbooks ready for things like a user account appearing in a stealer log dump or mass reset of all VPN passwords due to a breach. Practice these in tabletop exercises. Importantly, IR plans should include steps to revoke tokens and sessions, not just reset passwords. When an incident occurs, remember to purge any active authentication sessions in addition to changing credentials otherwise an attacker could still be in with a valid session after a password change. Ensure you know how to quickly turn off or rotate API keys and OAuth tokens if they leak a lot of organizations find they have no easy way to centrally revoke all AWS tokens, for example, which is scary in an incident. Another best practice is to integrate your identity logs like Okta or Azure AD logs with your SIEM so that during a suspected credential compromise, you can swiftly see what that account did and from where. Speed is of the essence, given that exploitation can be near instant once data is sold. An IR drill might involve simulating that an executive’s account credentials were found in a dump walk through who gets alerted, how you verify if the account was abused, how you communicate and remediate. Being prepared can save precious hours in a real event.
7. User Education Focused on Modern Threats: Revamp security awareness training to highlight things like infostealer malware and modern phishing. Many users understand not to click weird attachments, but they may not realize that copying a command from a website like the ClickFix PowerShell scenario can be just as bad. Educate them on consent based attacks i.e., hackers tricking you into installing the malware yourself under the guise of a needed update or fix. Train them to verify unusual system prompts or IT requests through official channels. Also, emphasize the danger of password reuse using concrete examples e.g., show how one leaked social media password led to a corporate breach. Encourage the use of password managers and unique passwords, so that even if one site’s credentials get stolen, it doesn’t affect work accounts. Given the AI enhanced phishing, it’s worth doing more frequent phishing simulations that reflect current tactics like very well crafted emails or even coordinated multi-channel phishing like an email followed by a phone call from an AI voice. The goal is to create a healthy skepticism in users and an instinct to report suspicious activity. Many companies in 2025 also started reward programs for employees who spot and report phishing attempts or other security issues positively reinforcing the behavior. Remember, humans are the last line of defense if all tech controls fail, so nurturing a vigilant workforce is key.
8. Protect and Monitor Privileged Accounts Intensively: If an infostealer nabs credentials, the worst case is if those belong to a domain admin or cloud admin. So, put extra hoops and monitoring around privileged users. Use dedicated admin accounts that are not used for email or web browsing so they are less likely to be exposed to phishing/malware. Employ privileged access management PAM solutions which require checkout of admin credentials for limited time use, and consider using hardware MFA for those accounts even if not broadly deployed elsewhere. Monitor all admin account activities if an admin logs in at 3 AM or from an unusual location, investigate immediately. Also implementing the principle of least privilege many breaches expanded because too many users had elevated rights they didn’t truly need. By limiting who can do what, you reduce the impact if one account is stolen. Some organizations in response to trends deployed things like just in time admin access, where nobody is a standing admin by default they must elevate through a controlled workflow that itself requires MFA and approval, making it harder for an attacker to get instant admin even with a stolen user credential. The statistics show privileged credentials are high on attackers’ wish lists when they search logs for admin entries, so our defense should treat those creds like the crown jewels.
9. Adopt Passwordless and Vaulting Strategies: Consider moving away from passwords where possible. For internal applications, explore options like passwordless login which might use a combination of device authentication and biometric or PIN, e.g. Windows Hello for Business. If users aren’t typing passwords, phishers can’t steal what isn’t there. For service accounts and non-human accounts, use vaults and secrets management don’t leave API keys or credentials sitting in code or config where malware can scrape them. Rotate secrets frequently. The fewer long lived static credentials in your environment, the less an infostealer can grab of value. This is a longer term strategy, but some companies started by implementing passwordless auth for VPN or certain SSO logins and reported good results in usability too. This also includes certificate based auth for devices, which can replace the need for device passwords in some cases. Essentially, breaking the paradigm of string of characters grants access and you break a lot of the infostealer’s power.
10. Collaborate with Law Enforcement and Intel Sharing: Engage with law enforcement and industry groups. Many police agencies and cyber authorities offer services where if they come across your credentials in a seized database or in a sting operation, they can notify you if they know who to notify. Being on those lists or part of intel sharing groups can give you early warning. Also, if you suffer a breach, consider sharing indicators like the hash of the malware or C2 IPs with a wider community. This collective knowledge can improve defenses for all and perhaps lead to the takedown of the culprits. In 2025, international operations took down major infostealer infrastructure like when Microsoft and others seized 2,300 Lumma C2 domains. Those successes often came from companies and law enforcement teaming up. By cooperating and not viewing security as solely a competitive advantage, organizations can help choke off the sources of these stealer logs in the first place e.g., legal action against hosting providers that cater to these operations.

By implementing these best practices, organizations create multiple layers of defense and response that directly address the pain points highlighted by the 2025 statistics. It’s about being proactive and resilient: assume you’ll be a target because frankly, everyone is, and then plan such that even if the attackers get in, they can’t get far, and you can eject them quickly. The theme is to clearly protect identities, anticipate compromise, and prepare to react swiftly. If widely adopted, these measures would make a serious dent in those troubling statistics in future reports.

FAQs Frequently Asked Questions

• What exactly is a stealer log and why is it so dangerous?

A stealer log is a collection of data that a piece of infostealer malware extracts from an infected system. Think of it as the loot from a cyber burglary. It often contains saved passwords, browser cookies which keep you logged into websites, credit card numbers, auto fill information, and system details. It can even include files or screenshots in some cases. These logs are dangerous because they package all this sensitive info into one bundle that is then sold or traded to other attackers. With a single stealer log, a criminal might hijack your email, bank account, and company VPN in one go. Essentially, it’s an all in one keyring to a victim’s digital life. The logs are formatted for easy search, so an attacker buying hundreds of logs can quickly filter for, say, paypal.com or admin@company.com and find valuable accounts to exploit. This mass, automated exploitation potential is what makes stealer logs one of the most significant threats today.

• How do cybercriminals get infostealer malware onto victims’ computers in the first place?

Cybercriminals use a variety of distribution tactics to infect systems with infostealers. The most common is phishing emails with malicious attachments or links for example, an email that looks like an invoice or a shipment notice, tricking the user into running a malware file. Another major method is malvertising and SEO poisoning, where attackers create fake ads or search results for popular downloads like free software or new games; clicking those leads to an infostealer download instead of the real app. We also see trojanized software on forums, cracked software, cheats for games, or even fake AI tools bundled with infostealers. In some campaigns, simply visiting a compromised website will prompt a download with instructions like Your browser is out of date, run this .exe to update the earlier mentioned ClickFix scam. Additionally, certain botnets or malware loaders drop infostealers as secondary payloads, especially if the initial malware determines the infected machine might have valuable data. In short, attackers typically rely on social engineering tricking the user or exploiting users’ desire for free/quick solutions to get that first execution of the infostealer on the endpoint.

• We use multi factor authentication. Can infostealers still defeat us?

Unfortunately, yes, many infostealers can bypass traditional MFA by stealing session cookies or tokens. Once you log in with MFA, the service often gives your browser a token cookie so you don’t have to login again for a while. Infostealers scoop those up. An attacker who has your session cookie can often log in as you without needing the MFA code, because the service thinks your cookie is proof you’re already authenticated. This technique is known as pass the cookie or session hijacking. Some advanced infostealers also target authenticator app data or OAuth tokens. That said, phishing resistant MFA like hardware security keys significantly raises the bar that is tied to the device and site, so a stolen session from one device won’t work on another. As a user, it’s still absolutely worth using MFA. It stops a huge amount of opportunistic attacks like someone simply knowing your password. But companies and users should be aware that MFA is not a silver bullet. You need to combine it with other measures like device trust and monitoring. If you use authenticator apps, be cautious of push fatigue attacks attackers trying to repeatedly send approval requests. And always, if you get an MFA prompt you didn’t initiate, that could mean your password was compromised and someone is trying to log in, deny the request and change your password immediately.

• If my company credentials are stolen, how would I know?

Detecting that your credentials were stolen can be tricky often, victims only realize when unusual activity occurs like logins from odd locations, or in worst case, a breach announcement. However, there are a few signs and steps:

• Unfamiliar Logins: Many services like Google, Microsoft 365, etc. notify users or admins of logins from new devices or locations. If you receive those alerts and it wasn’t you, that’s a red flag.
• Password Sprays/Account Lockouts: If attackers try your creds, you might see account lockouts or many failed login attempts in logs. Suddenly getting locked out could mean someone else was tinkering with your account.
• Dark Web Monitoring: As an individual, you can use services like HaveIBeenPwned to see if your email appears in known data breaches. Companies use commercial monitoring to get alerted if their accounts show up for sale. If you’re notified by such a service, take it seriously.
• Unwanted MFA Prompts: As mentioned, if you use MFA and randomly get a prompt to approve a login when you weren’t trying that could mean someone has your password and is testing it.
• Device Clues: If your work computer gets infected by malware antivirus alert or weird behavior, assume credentials might be compromised. Infostealers are stealthy, but sometimes they’re bundled with noisier malware or cause performance hiccups.

In practice, many companies find out credentials were stolen only after a third party law enforcement or security researcher informs them, or after a secondary incident like a ransomware attack traces back to a stolen credential. This is why being proactive monitoring and having an incident response plan is important. If you even suspect theft, lost laptop, malware infection, etc., it’s wise to change passwords and invalidate sessions as a precaution.

• How do stealer logs tie into ransomware incidents?

Stealer logs have become the feedstock for ransomware gangs through a network of initial access brokers. Here’s how it works: Ransomware groups often don’t phish you directly; instead, they let infostealer malware campaigns gather as many logins as possible from many organizations. These stolen log databases are then scoured for juicy targets like domain admin credentials, VPN logins, or accounts that indicate access to critical systems. Verizon's 2025 DBIR found that 54% of ransomware victims had their domains appear in infostealer logs or credential-marketplace postings before disclosure; that shows exposure, not proof the attackers used those credentials. What happens is an Initial Access Broker IAB will purchase stealer logs or subscribe to a botnet feed and filter them for, say, big company domains or high privilege accounts. When they find something like acme corp.com VPN login for JohnDoe, they’ll test it. If it works, they package that access, perhaps even establishing a backdoor for persistence and then auction it off in hidden forums where ransomware affiliates lurk. The highest bidder or a partnered ransomware gang buys the access, logs in, and then proceeds to deploy the ransomware encryption across the network or exfiltrate data first to double extort. This specialization means ransomware attackers can focus on the payload and extortion, while others handle the breaking in part via stolen creds. In practical terms, if an organization’s user appears in a stealer log marketplace, they could have ransomware on their network within days. That’s why we emphasize monitoring those markets and preemptively resetting creds to break that kill chain early.

• Are certain types of accounts or data more valuable in stealer logs?

Yes, not all stolen data is equal attackers place higher value on some log contents:

• Privileged Credentials: Administrator accounts IT admins, cloud console accounts, etc. are the crown jewels. They allow direct high level access. These can fetch high prices and lead to major breaches, as they did in some cases like the SolarWinds incident or the Okta support breach.
• Corporate Credentials: Logins to enterprise services VPNs, Remote Desktop, internal tools are very sought after by initial access brokers and espionage actors. Even a low level employee’s VPN could be a foothold for network intrusion. Corporate email accounts are also valued, as they often serve as stepping stones for further phishing or fraud. Among the ransomware victims whose domains appeared in infostealer logs or credential markets, Verizon's 2025 DBIR found 40% had corporate email addresses in the exposed credentials.
• Financial Accounts: Anything with money attached to online banking, PayPal, cryptocurrency wallets is obviously prized by cybercriminals. Logs containing these can be monetized immediately to steal funds or sold to fraudsters. Cryptocurrency wallet data like seed phrases or wallet files is particularly hot since crypto transactions are irreversible.
• Web Session Cookies: Cookies for authentication to platforms like AWS management console, VPN web sessions, etc. are valuable because they can bypass MFA. Some marketplaces explicitly highlight logs with Auth Tokens for major service.
• Personal Identifiable Info PII: Large dumps of PII names, SSNs, addresses often called fullz are used for identity theft. While one person’s data might not sell high individually, big collections do because they feed scams and synthetic identity fraud.
• API/Cloud Keys: Stealer logs can sometimes snag API keys, cloud access tokens, SSH keys, etc., if those are stored on disk or in files. These machine credentials are extremely valuable to attackers because they might allow direct server access or database dumps. For example, a log containing an AWS Secret Key that grants admin access to a cloud environment could be more devastating than any one user’s password.
• Intellectual Property: On occasion, logs might contain saved documents, software license keys, or design files. State sponsored hackers in particular might target those e.g., looking for defense contractor docs. While not the typical content of a stealer log, some stealers do grab specific file types like PDFs, DOCs if configured to.

In summary, attackers triage stealer logs for access that leads to money or strategic gain. Everything else like generic forum logins or old passwords is noise to them or used in bulk for less targeted crimes. This is why an infostealer infection in an enterprise is so dangerous even if 90% of what it steals is low value, that remaining 10% of the keys to important accounts is enough to cause a disaster.

• Can organizations do anything to disrupt the stealer log supply chain?

It’s challenging, but there are a few approaches:

• Takedowns and Law Enforcement: Companies can collaborate with law enforcement and cybersecurity firms to target the infrastructure behind infostealers. For example, Microsoft and others have in the past taken legal and technical action to seize domains or servers used by malware like Lumma. Every takedown like the Operation Magnus that hit RedLine in 2024 at least temporarily disrupts that supply chain. Supporting these efforts via intel sharing or legal resources is one way organizations contribute to a larger fight.
• Sinkholing and Intelligence Feeds: Researchers sometimes sinkhole botnets meaning, reroute some of the malware traffic to benign servers they control. This can yield huge lists of stolen credentials that they can then inform victims about or build protective feeds for example, have I seen any of those credentials used in my environment?. By consuming such threat intelligence, an organization indirectly helps degrade the value of the stolen logs because if all potential victims reset their creds quickly, the logs are less useful for attackers.
• User Education & Hygiene: Reducing the success of infostealers in the first place will dry up the supply. That means patching browsers and apps to prevent exploit driven installs, training users not to run random downloads, and not using personal devices for work or at least securing them. If malware infections drop, there’s simply less data to sell. Granted, that’s easier said than done on a global scale, but every bit counts.
• Adopt Passwordless Future: If the industry moves towards passwordless authentication and token bound systems, stealer logs lose a lot of value. For instance, if an account requires a hardware key that can’t be duplicated, stealing data won’t grant access. Organizations advocating and implementing modern auth standards FIDO2, OAuth with proof of possession, etc. collectively push the ecosystem to where stolen static credentials are less useful. It’s somewhat analogous to how widespread chip and PIN cards reduced the value of stolen card dumps though criminals adapted with online fraud, but it changed the game.
• Targeting the Money Flows: Going after the cryptocurrency laundering networks that criminals use can indirectly impact them. Many stealer log and ransomware operations rely on converting stolen crypto or payments into cash. If international efforts make it harder to cash out anonymously through exchange regulations, etc., it could deter some actors. This is more in the hands of governments and policy, but companies can lobby for it.
• Market Devaluation via Overload: There’s an interesting notion with tens of billions of records floating around (SpyCloud counts 65.7 billion), we’re almost at a point of breach data overload. Some security experts mused that if everything is breached, the value of any one credential drops. That’s not a strategy per se, but it suggests that eventually, organizations might operate under the assumption that credentials will be exposed and instead focus on contextual security transactions monitoring, anomaly detection to mitigate misuse. In a way, that deprives criminals of easy wins because even with valid creds, they get spotted by behavior. It’s like raising the cost on their end. They have to work harder to use stolen creds, making the markets less attractive.

In sum, while a single organization can’t stop stealer logs globally, collective actions and internal strategies can chip away at the ecosystem. It’s akin to public health: one company practicing good security hygiene won’t eradicate a malware pandemic, but if many do, the overall infection rate can go down. Until then, being prepared internally as outlined in best practices is the immediate defense.

The statistics and trends from 2024–2025 deliver a sobering verdict: we are in the midst of an identity compromise industrial revolution. Cybercriminals have industrialized the theft and abuse of credentials through infostealer malware and dark web marketplaces, fundamentally lowering the cost of entry for launching damaging attacks. A single infostealer infection on one PC can silently unlock dozens of accounts; multiply that by millions of infections, and we have billions of keys to organizations floating in the wrong hands. It’s no wonder that metrics show stolen credentials featured in the vast majority of breaches, and over half of ransomware victims had their domains in infostealer logs or credential markets beforehand.

Yet within these daunting statistics lies a clear direction for defense. The numbers impart a crucial lesson: to protect our data, we must protect our identities. Organizations need to treat credentials as the new perimeter and invest accordingly from enforcing MFA and device trust to monitoring for exposed passwords and tightening session controls. The old paradigm of threat prevention, which focused on keeping malware out, must evolve into a paradigm of access management and breach containment, assuming some malware will get in and some credentials will leak. Speedy detection and response, guided by threat intelligence like catching your credentials on sale before criminals use them, is now as important as traditional prevention.

The global and regional breakdowns also remind us that this is a collective challenge. No region or industry can afford complacency; whether you’re a hospital in North America or a manufacturing firm in Asia, the same infostealer kits are targeting your employees and the same markets are trading your credentials. Sharing knowledge and adopting best practices widely will be key to stemming the tide. IBM's 2025 report showed a dip to $4.44M as containment got faster, but its 2026 report put the average at a record $4.99M, so faster detection alone has not held costs down. More organizations are embracing zero trust principles, which could over time reduce the impact of stolen logins.

In closing, the data is both a warning and a guide. The explosion of stealer log statistics warns us that if we continue business as usual, we’ll remain outpaced by attackers who are capitalizing on our weakest links. But the data also guides us to the solution: focus on identities, focus on rapid intel and response, and adapt our defenses to the modern threat model. By translating these statistics into action as we outlined in the best practices organizations can turn the tide. The task is urgent: as of 2025, credentials are effectively a commodity on underground markets. Our collective mission in the years ahead is to make them much harder to steal, harder to use, and far less valuable to attackers. The companies that succeed in this will not only see their own breach numbers improve but will also contribute to drying up a core fuel of the cybercrime economy. The hope is that when we look at the Stealer Log Statistics in a future report, we’ll see a downward trend, a sign that we’ve reclaimed some ground in this battle for digital identity.

About the Author

Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.