2.86 Billion Credentials Compromised, Enterprise Access for Sale

Key Takeaways

• Over 2.86 billion credentials have been compromised, flooding criminal markets and driving down the price of individual login data.
• The value of verified enterprise access has surged dramatically, with some listings increasing by over 4,000% in a year.
• Infostealer malware is a primary driver of this trend, capturing browser data, cookies, and passwords that bypass traditional authentication.
• Stolen session cookies are particularly valuable to attackers as they can bypass multi-factor authentication (MFA).
• Organizations must prioritize robust session management, phishing-resistant MFA, and continuous verification to counter these evolving threats.

Dark Web Economy Shifts as Enterprise Access Becomes Premium Commodity Amidst Credential Flood

The illicit market for stolen login information has undergone a significant transformation, with a massive influx of compromised credentials driving down their individual value while verified access to major corporations commands increasingly higher prices. This bifurcation in the underground economy is largely fueled by the proliferation of infostealer malware.

Infostealers typically infect victims through various deceptive tactics, including phishing emails, fake software updates, pirated downloads, or malicious email attachments. Once a system is compromised, these tools extract sensitive data such as browser passwords, cookies, and other digital artifacts. This stolen data is then weaponized to gain unauthorized entry into cloud services, VPNs, and critical business accounts. Security researchers at DarkOwl noted the shift in a report recently shared with Cyber Security News (CSN).

The report highlights an alarming figure of 2.86 billion compromised credentials projected for 2025. Complementary analysis revealed that 1.8 billion credentials were stolen in the first half of the year alone, representing an 800% increase compared to the preceding six months. This overwhelming volume of readily available records fundamentally alters the landscape of digital identity, rendering a simple username and password insufficient as proof of identity. The criminal underworld now prioritizes immediate, actionable access to high-value organizational targets.

Billions of Credentials Flood Criminal Markets, Driving Down Prices

At the lower end of the dark web market, stolen personal information is priced for mass acquisition. A Social Security number might fetch between $1 and $6, while a basic name and email combination could sell for less than $15. A comprehensive identity package, however, can range from approximately $20 to $100. Payment card details, including the security code, typically trade for $10 to $40. This abundance of data means that old credentials can be tested across numerous services, and fresh logs often contain browser data crucial for account takeovers. Recent findings on infostealer logs and cloud breaches demonstrate how stolen credentials are increasingly becoming the initial vector for corporate system infiltration.

Conversely, the premium segment of the market is witnessing a drastic upward trend. DarkOwl’s research indicated that the average price for initial access broker (IAB) listings across five prominent dark web forums skyrocketed from approximately $2,726 in 2024 to an astounding $113,275 in 2025. This staggering 4,055% increase is largely attributable to a select number of listings claiming access to highly lucrative, high-revenue organizations. While typical access might still cost hundreds or thousands, this surge signifies the emergence of an ultra-premium tier for entry into large enterprises. Healthcare records, which possess enduring value as they cannot be simply canceled and reissued, maintained a price range of $250 to $310 each, with verified cryptocurrency accounts also commanding elevated prices.

For cybersecurity defenders, rising prices on the dark web serve as a critical early warning signal regarding attacker interest, rather than a precise quantification of exposure. Organizations operating in sectors such as healthcare, finance, and critical infrastructure are strongly advised to conduct thorough reviews of their internet-facing systems, privileged accounts, and internal movement detection capabilities. The escalating trade in initial access broker listings underscores the urgency of such reviews following any credential compromise.

Session Cookies Emerge as a Prime Target for MFA Bypass

Beyond simple passwords, stolen session cookies have become a highly sought-after commodity. These small data files, which allow users to remain logged into a service after initial authentication, are valuable because they enable attackers to replay an approved session. In practice, this technique can effectively bypass both password prompts and conventional multi-factor authentication (MFA) checks.

This method does not inherently imply a failure of MFA itself, but rather highlights the necessity of securing the session *after* successful sign-in. Recent reports on pass-the-cookie MFA bypass attacks demonstrate how sophisticated malware and phishing campaigns are designed to capture these session tokens for unauthorized reuse without requiring a new authentication code.

DarkOwl advises implementing shorter session lifetimes, binding sessions to specific devices where feasible, and actively monitoring for session replay attempts. Furthermore, security teams should transition towards phishing-resistant MFA solutions and embrace continuous verification models, moving beyond the reliance on passwords and SMS codes as sufficient proof of identity. These controls significantly diminish the value of the data that cybercriminals actively seek to acquire.

The illicit market is not only expanding but also becoming more discerning. While bulk credential dumps continue to depreciate in value, AI-curated records specifically tailored to a particular company or role can command a premium. This is because such targeted data facilitates more effective fraud and phishing campaigns. Reports detailing phishing kits designed to steal session tokens further emphasize the attackers’ focus on gaining authenticated access, rather than merely acquiring static passwords.

Dark web pricing trends should be interpreted as an early warning indicator. Security leaders can leverage this intelligence, in conjunction with exposure monitoring and incident response strategies, to prioritize and strengthen their defenses. The overarching message from the 2.86 billion compromised credentials is clear: even cheap stolen data can lead to exorbitantly expensive enterprise compromises.

What You Should Do

• Implement Phishing-Resistant MFA: Move beyond SMS or traditional app-based MFA to FIDO2/WebAuthn or certificate-based authentication which are more resistant to phishing and session token theft.
• Strengthen Session Management: Enforce shorter session lifetimes, implement session binding to devices where possible, and deploy robust monitoring for unusual session activity or replay attacks.
• Educate Users on Infostealer Threats: Conduct regular training on identifying phishing, malicious downloads, and fake updates that deliver infostealer malware.
• Monitor for Credential Exposure: Utilize dark web monitoring services to identify if your organization’s credentials, or those of your employees, appear in compromised data dumps.
• Review and Secure Internet-Facing Systems: Regularly audit and harden all public-facing applications and services, ensuring strong authentication and patching vulnerabilities promptly.
• Implement Zero Trust Principles: Adopt a “never trust, always verify” approach, continuously authenticating and authorizing users and devices, even within the network perimeter.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.