The Rise of Service-Centric Credential Compilations
Brief
How Cybercriminals Are Repackaging Infostealer Data
Over the last year, the underground economy has undergone a significant transformation. Cybercriminals are no longer focused on distributing massive collections of raw infostealer logs, they are increasingly investing time in organizing and enriching stolen information into service-specific compilations. These datasets are no longer random collections of credentials extracted from infected endpoints.
Instead, they are carefully curated packages containing only the information associated with a particular online service such as ChatGPT, Netflix, Microsoft 365, Google Workspace or social media platforms. This evolution reflects the growing professionalization of the cybercriminal ecosystem and the increasing demand for ready-to-use access rather than raw data.