Who needs phishing when your login's already in the wild?
Stolen credentials edge out email tricks for cloud break-ins because they’re so easy to get
Criminals used stolen credentials more frequently than email phishing to gain access into their victims’ IT systems last year, marking the first time that compromised login details claimed the number two spot in Mandiant’s list of most common initial infection vectors.
“Credential stealers have been and are a major issue, but we have seen a resurgence recently,” Mandiant Consulting VP Jurgen Kutscher said in an interview with The Register about the nearly 100-page M-Trends 2025 report from the Google-owned security shop.
“Email tends to be noisier and easier to detect with phishing detection,” he added. “There is an entire cybercrime business surrounding stolen credentials that promotes the sale – and use – of stolen credentials.”
Related Knowledge Center: Digital privacy and data security
If you’re online, you’re generating a constant stream of information about yourself — sometimes voluntarily, sometimes unwittingly — that is assembled and used to craft your online experience. And generate wealth for data brokers. Meanwhile, designers and managers of the digital infrastructure on which the world depends are engaged in a never-ending effort to thwart attempts, by both criminal enterprises and state actors, to exploit vulnerabilities in those systems.
Signalgate | State surveillance