2.86 Billion Credentials Flood Criminal Markets as Enterprise Access Moves Upmarket
Brief
Stolen login data is so abundant that criminal markets can sell it for almost nothing.
Meanwhile, verified entry into large companies commands far higher prices, reshaping the underground economy.
Infostealer malware drives that divide. It reaches victims through phishing lures, fake updates, pirated downloads or malicious attachments, then collects browser passwords, cookies and data.
The logs are reused against cloud services, VPNs and business accounts. Analysts at DarkOwl noted the shift in a report shared with Cyber Security News (CSN).
The report cites 2. 86 billion compromised credentials in 2025, while another analysis counted 1. 8 billion stolen in the first half, an 800% jump from six months earlier.
The result reaches well beyond a reused password. A correct username and password can no longer prove identity when criminals can buy huge volumes of records.