Security teams that monitor for exposed credentials face more alerts than they can act on. Every week brings new breach dumps and combolists, each with fresh matches against a company’s domain, and treating every match as equally urgent buries the important ones.
Over the past year, my team analyzed 31.5 million exposed credentials linked to 4,824 organizations in the US and Europe by where each one came from.[1] About 97% came from breach dumps and combolists. The remaining 844,000 or so, under 3% of the total, came from infostealer logs, and 72% of the organizations were impacted by at least one of them.
OLD CREDENTIALS STILL NEED CLOSING OFF
Most breach dump and combolist entries are recycled from older leaks, and some contain passwords that have since been reset. They still carry risk. People reuse passwords, so a login leaked from one service can open another years later through credential stuffing. In October, Meta disclosed that attackers had reached some of its GitHub repositories using a single employee’s stolen credentials. For this part of the exposure, the aim is to make sure old passwords no longer work, by enforcing multi-factor authentication and blocking passwords already known to be compromised.
WHAT AN INFOSTEALER LOG TELLS YOU
An infostealer log provides evidence of malware infection on a specific device and is more likely to reflect recent theft, while a combolist entry can be years old. The malware takes whatever the browser has saved on that machine: passwords for other services, autofill data, system details and session cookies, and sometimes even documents. One infection can therefore put many accounts at risk at once, and the credential that triggered the alert is only one of them.
The 2024 campaign against Snowflake customers showed how long that signal can sit unnoticed. Attackers logged in to customer instances with stolen credentials, many harvested by infostealers as far back as 2020, and Mandiant found that at least 79.7% of the accounts used had prior credential exposure. My team found that a Snowflake employee’s credentials for a demo account without MFA had likely been stolen by Lumma Stealer on October 5, 2023, more than six months before the campaign came to light.
Session cookies are the part most often overlooked. A stolen cookie can let an attacker reuse a logged-in session and bypass multi-factor authentication entirely, so a password reset on its own can leave the attacker with access. Cookies are short-lived, which makes speed more important for this
STAFF ACCOUNTS AND CUSTOMER ACCOUNTS
Whose credential it is changes the response. In our data, 41% of organizations had at least one malware-stolen credential on a staff email address. A staff credential stolen by malware is the closest the data comes to showing malware on a device used for work, although the device could be personal rather than company-owned. The figure is probably low, because staff who sign in with a username rather than an email address are counted as customers for the purpose of the report. Another 31% of organizations had infostealer credentials only on customer accounts.
Industry shapes this far more than location. Financial Services led on the share of organizations with a malware-stolen credential, at 77%, but had one of the lowest shares on staff addresses, at 36%, which points to customers as the main target. Business Services showed the opposite pattern, with low credential totals and the highest share of organizations holding a malware-stolen staff credential, at 47%. Across six European regions, the share of credentials stolen by malware stayed between 1.7% and 2.7%.
For a staff credential, the starting point is the user and the device. Find out which machine was infected and what else was saved on it, then reset the passwords stored in its browser and revoke active sessions for each of those accounts. Removing the malware is as important as the resets, since a device that is still infected will hand over the new passwords as well.
For a customer credential, the job is protecting the account: force a reset, end existing sessions, require additional verification at the next login and watch for fraudulent activity. Customer credentials that turn up in a breach dump deserve their own check, because they can mean one of the organization’s own sites was breached.
At scale, routing does much of the work. Staff hits belong with the security team and customer hits with fraud or identity teams, and both queues work better when they are ranked by
Most credential monitoring is already good at finding exposed logins. The next step for security teams is prioritizing credentials by risk, starting with theirocking, and those stolen by infostealers are escalated for immediate investigation
Borja Rodriguez is Head of Threat Intelligence at Outpost24, specializing in threat intelligence research, offensive security, penetration testing, and red teaming.
1. 2026 Credential Exposure Benchmark Report, credentials first detected between September 1, 2025 and September 1, 2026: https://outpost24.com/resources/2026-credential-exposure-benchmark-report/
