Intelligence
Analysis of stealer-log data since 2020: government-sector exposure and administrator credential leakage, drawn from our indexed collections.
Every day, hackers use malware to gain access to thousands of user accounts. Very often these users are employees of government organizations running a virus on a machine where passwords to government resources were stored. The chart below shows leaked accounts for government resources across countries, based on our analysis since 2020:
Accounts of administrators and developers also fall into attackers' hands. With this data, criminals can steal entire user bases, drain cryptocurrency accounts, or pivot into corporate networks. Counted below are administrator accounts found in leaks so far:
Freshly indexed credential records per day over the last month. Spikes usually follow takedowns of distribution networks and the release of new log batches on underground markets.
The yearly view shows how the underground supply of stolen credentials keeps growing month over month.
Which infostealers harvested the indexed credentials worldwide. A long tail of private and rebranded builds keeps the landscape shifting.
In most cases users become vulnerable by downloading cracked software — currently the most common delivery vector. Less common but real: social engineering, trojanized free products, and even compromised official websites distributing malware through installers and updates.
Anyone can fall victim. Don't save passwords in your browser, keep your OS and anti-virus up to date, and never run software from untrusted sources.