SpyCloud: "50% of dark web credentials originate from infostealers"

Infostealers are on the rise, and with them, the statistics tracking this growing threat. Many companies publish reports, but what do those numbers really mean? We delved deeper into the data to give you the full story. No time to go through it all? Our Passguard rating system scores the value of statistics on a scale from 1 to 5. Convenient, right?

The traditional image of leaked data on the dark web often involves massive data breaches, where large quantities of personal data such as passwords are published. However, this data is often outdated. For example, a password might be stolen in a 2019 hack, even though the account was created back in 2013, and the data dump may not appear on the dark web until 2023. This is different with infostealers. The malware steals the most recent sessions and login credentials stored in the user’s browser at that moment. For hackers, the quality of this data is much higher.

SpyCloud noted in a previously published report that infostealer infections are also overtaking traditional data breaches in terms of quantity. In their annual Identity Exposure Reportfrom 2023, SpyCloud observed that 48.5% of the 721 million newly published credentials on the dark web came from infostealers.

However, in the 2024 edition, SpyCloud did not provide an update on this statistic, possibly because the share had slightly decreased. For example, in 2022, around 350 million credentials from infostealer logs were published, whereas this number dropped to 344 million in 2023.

‍Conclusion

‍SpyCloud’s analysis of the source of published credentials offers a fresh perspective on the impact of infostealers. The only drawback is that the statistic was not updated in 2024, and there is no clear time trend provided. Nevertheless, this report contributes to a better understanding of the influence of infostealers, which is why we give it four bullets.