What are the attackers doing with them?

If your organization’s credentials are leaked, immediate results are rare, but the long-term impact is far-reaching. Far from the cloak and dagger tactics seen in fiction, many real-world cyber violations begin with the seemingly simple thing: usernames and passwords.

According to Verizon’s 2025 Data Breach Investigation Report, leaked credentials accounted for 22% of violations in 2024, outweighing phishing and software exploitation. This is almost a quarter of all incidents and is started by logging in through the front door rather than zero-day or a highly persistent threat.

This quiet and persistent threat continues to grow. New data compiled by CyberInt (an external risk management and threat intelligence company recently obtained at checkpoint) has seen a 160% increase in credentials leaked in 2025 compared to the previous year. The report, entitled Rise of Leaked Credentials, examines not only the amount of these leaks, but how they are being exploited and what organizations can do to move on from them. It’s definitely worth reading for the risk reduction manager.

Surges driven by automation and accessibility

Volumes aren’t the only way to raise leaked credentials. There is also information on speed and accessibility. In just one month, Cyberint has identified more than 14,000 company qualification exposures related to organizations whose password policies are still intact.

Automation has made it easier to know your credentials. Infostealer malware, often sold as a service, allows even less skilled attackers to harvest login data from browsers and memory. AI-generated phishing campaigns can mimic tone, language and branding with eerie accuracy. Once the credentials are collected, they are either sold in underground markets or offered in bundles on telegram channels and illegal forums.

As outlined in the eBook, the average time it takes to repair leaked credentials via the GitHub repository is 94 days. This is a three-month window where an attacker exploits access and is not detected.

How Credentials are used as currency

The leaked credentials are the attacker’s currency, and their value exceeds the initial login. Once retrieved, these credentials become a vector of various malicious activities.

Account Takeover (ATO): An attacker logs into a user’s account and sends phishing emails from legitimate sources, tamper with data, or launches financial scams. Qualifications: If a user reuses passwords across the service, one account violation can lead to another in a chain reaction. Spam distribution and bot networks: Email and social accounts act as launchpads for disinformation, spam campaigns, or promotional abuse. Email and Erotic Tor: Some actors have contacted the victim and threatened to expose their eligibility unless payment is made. You can change your password, but if the scope of the violation is unclear, the victim often finds himself in panic.

Downstream effects are not always obvious. For example, a compromised personal Gmail account may provide attackers with access to corporate service recovery emails, or discover shared links in sensitive attachments.

Seeing what others have missed

Currently part of the checkpoint, Cyberint uses automated collection systems and AI agents to monitor a wide range of sources across the open, deep and dark web. These systems are designed to detect leaked credentials at scale, correlating details such as domain patterns, password reuse, organizational metadata, and more to identify possible exposures, whether anonymously posting or bundled with others. The alerts enrich the context to support rapid triage, and integration with the SIEM and SOAR platforms allows for immediate actions such as revoking credentials and performing password resets.

Cyberint analysts then intervene. These teams conduct targeted investigations at closed forums, assess the reliability of threat actor claims, and stitch together identity and attribution signals. By combining machine-driven coverage with direct access to underground communities, CyberInt offers both scale and accuracy. Allows teams to act before leaked qualifications are actively used.

Credential leaks do not occur only on monitored workstations. According to Cyberint data, 46% of devices associated with corporate credential leaks are not protected by endpoint monitoring. These include personal laptops or unmanaged devices that allow employees to access business applications.

CyberInt’s threat detection stack integrates with SIEM and SOAR tools to allow automated responses the moment a violation is identified, such as revoking access or forcing a password reset. This closes the detection and action gap. This is an important factor every hour.

The complete report deepens how these processes work and how organizations operate this intelligence across their teams. For more information, see the entire report here.

Exposure detection is currently a competitive advantage

Even with secure password policies, MFA, and latest email filtering, credential theft remains a statistical possibility. What distinguishes organizations is how quickly exposures are detected and how well the remediation workflow is.

The two playbooks featured in the eBook show how teams can respond effectively, both with employee and third-party vendor credentials. Each step outlines the steps for discovery, source validation, access revocation, stakeholder communication, and post-incormende review.

But this is the important point. Proactive discoveries are more important than reactive forensic medicine. Waiting for a threat actor to make the first move will increase dwell time and increase the range of damage.

The ability to identify credentials immediately after their appearance in underground forums before they are packaged or weaponized in automated campaigns is what separates successful defenses from reactive cleanups.

If you’re wondering whether your organization publishes credentials floating on the deep or dark web, you don’t need to guess. You can check it.

It’s not just mitigation

A single control cannot completely eliminate the risk of credential exposure, but multiple layers can reduce the impact.

Strong Password Policy: Periodic password changes and prohibit inter-platform reuse. SSO and MFA: Add barriers beyond passwords. Even basic MFAs make the stuffing of credentials much more effective. Rate Limit: Try to set login thresholds to confuse brute force and qualification spray tactics. POLP: Compromised accounts do not provide broader entries as they restrict user access to only what they need. Fishing Awareness Training: Educate users on social engineering techniques to reduce early leaks. Exposure Monitoring: Implement detection across forums, marketplaces and pasting sites to flag corporate credential mentions.

Each of these controls is useful, but together, it is not sufficient if the exposure is not noticed for weeks or months. That’s where detection intelligence from Cyberint comes in.

Reading the full report will help you learn more.

Before the next password is stolen

It doesn’t matter if the accounts associated with the domain are published. It’s already happened. The real question is, was it found?

Currently, thousands of credentials associated with active accounts are passed around markets, forums and telegram chats. Many belong to users who still have access to corporate resources. Some may contain bundled metadata such as device types, session cookies, and even VPN credentials. Once shared, this information spreads quickly and becomes impossible to withdraw.

Identifying exposures before they are used is one of the few meaningful benefits defenders have. And it starts with knowing where to look.

Threat intelligence plays a central role in detection and response, especially when it comes to publicly published credentials. Given the widespread distribution across the criminal network, credentials require a clear process for focused monitoring and mitigation.

Check if your company’s qualifications are open, deep, and dark web publicly available. The earlier they are discovered, the fewer incidents they will respond later.