Recorded Future

Each compromised device yielded an average of 87 stolen credentials.

90% more credentials were identified in the last three months of 2025 than in the first three months

Over half of all credentials (53%) were indexed within one week of exfiltration, and 36.4% within 24 hours.

276 million of the credentials indexed in 2025 included active session cookies.

50% more credentials were identified in the second half of 2025 than in the first half of the year.

Of the 7 million credentials indexed with identifiable authorization URLs, 63.2% were tied to authentication systems.