Credential Theft and Identity-Based Intrusions Surge Across Enterprises

Credential compromise and identity abuse are increasing as attackers rely more on stolen logins, session artifacts, and phishing rather than noisy exploitation alone. Recorded Future reported a sharp rise in exposed credentials during 2025, including nearly 2 billion credentials indexed from malware combo lists, with the second half of the year up 50% over the first and Q4 up 90% over Q1. The trend is being driven by the industrialization of infostealer malware, malware-as-a-service ecosystems, and AI-enabled phishing and social engineering, while weak identity governance continues to expand the attack surface. A separate survey of UK organizations found 77% fail to promptly disable former employees' accounts, 34% grant overly broad access, and many still use manual processes such as spreadsheets for account validation, creating persistent opportunities for unauthorized access.

A targeted phishing attempt against Outpost24 illustrates how these identity-focused attacks are being operationalized against even security vendors. Attackers used a convincing fake JP Morgan email, valid DKIM authentication via Amazon SES infrastructure, and a seven-stage redirect chain leveraging trusted brands including Cisco to steer a C-suite executive toward a Microsoft Office credential-harvesting page while evading email defenses. The broader threat environment shows the same shift toward access abuse and stealthier post-compromise tradecraft: Google Threat Intelligence Group found ransomware actors increasingly favor native Windows tools over Cobalt Strike, with data theft present in 77% of incidents and exploitation of VPNs and firewalls still common for initial access. Together, the reporting shows attackers are increasingly logging in rather than breaking in, then using legitimate access and built-in tools to deepen compromise and extort victims.