Threat Intel - 2025 Identity Threat Landscape Revealed

The Threat

In 2025, credential theft became the leading method for cyber breaches. Recorded Future's report highlights that 1.95 billion credentials were exposed through malware. This alarming trend indicates that attackers are increasingly targeting systems with high access potential, such as authentication systems and VPNs. The report reveals a staggering 50% increase in credential theft in the latter half of the year compared to the first half, with a 90% spike in the last quarter alone. This surge underscores the growing sophistication of infostealer malware and the need for robust defenses.

Who's Behind It

The primary threat comes from infostealer malware, particularly the LummaStealer, which dominated the landscape in 2025. This malware operates under a malware-as-a-service (MaaS) model, allowing attackers to efficiently harvest credentials from compromised devices. The report notes that each infected device yielded an average of 87 stolen credentials, affecting both corporate and personal accounts. The evolution of this malware has made it increasingly difficult for traditional security measures to keep pace, as attackers exploit vulnerabilities in systems that organizations rely on for security.

Tactics & Techniques

Attackers are not just randomly stealing credentials; they are targeting specific systems that offer the greatest potential for exploitation. Over 63% of the compromised credentials were linked to authentication systems, with significant numbers also tied to cloud platforms and remote management tools. This strategic targeting allows attackers to gain broad access to organizational networks, making it crucial for security teams to prioritize monitoring these high-risk areas. Furthermore, the report highlights that 276 million credentials included active session cookies, enabling attackers to bypass multi-factor authentication (MFA) entirely. This emphasizes that MFA alone is no longer sufficient to protect sensitive data.

Defensive Measures

To combat these threats, organizations must adopt a proactive stance. Continuous monitoring for credential theft is essential, as the pace of exposure is rapid. Security teams should focus on detecting compromised credentials tied to authentication systems and remote access tools. Implementing shorter session token lifespans for high-risk applications and treating any credential exposure as a potential authentication bypass will enhance security. The report underscores the importance of swift action; organizations that respond quickly to intelligence can prevent the exploitation of stolen credentials, ultimately safeguarding their networks from serious breaches.