We come across a lot of passwords that are put up for sale every day on the dark web. Cybersecurity company SpyCloud’s 2023 Identity Exposure Report shows us how serious the situation is.
According to the report, 721.5 million exposed credential detected in 2022. 50% of these credentials came from botnets that are controlled by threat actors for information stealing.
“The pervasive use of infostealers is a dangerous trend because these attacks open the door for bad actors like Initial Access Brokers, who sell malware logs containing accurate authentication data to ransomware syndicates and other criminals.. Infostealers are easy, cheap, and scalable, creating a thriving underground economy with an ‘anything-as-a-service’ model to enable cybercrime. This broker-operator partnership is a lucrative business with a relatively low cost of entry,” said Director of Security Research at SpyCloud Trevor Hilligoss.
One of the biggest results of the study is 72% of users exposed in 2022 breaches were still reusing the compromised passwords.
Also, during the study, researchers recaptured nearly 22 billion device and session cookies in 2022. These information gives attackers access to sensitive information withhout MFA. Also 74% of exposed government credentials across the globe in 2022 were exfiltrated by malware.
To download the full report: https://spycloud.com/resource/2023-annual-identity-exposure-report/