--- title: More Attackers Are Logging In, Not Breaking In | daily.dev description: Credential theft has become the dominant initial access vector for attackers, with Recorded Future indexing nearly two billion stolen credentials in 2025. The... canonical: https://daily.dev/posts/more-attackers-are-logging-in-not-breaking-in-9v6pmdhfh twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: More Attackers Are Logging In, Not Breaking In | daily.dev og:description: Credential theft has become the dominant initial access vector for attackers, with Recorded Future indexing nearly two billion stolen credentials in 2025. The... og:url: https://daily.dev/posts/more-attackers-are-logging-in-not-breaking-in-9v6pmdhfh og:image: https://api.daily.dev/og/posts/9V6pmdHFh.png og:image:alt: More Attackers Are Logging In, Not Breaking In og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # More Attackers Are Logging In, Not Breaking In **[Dark Reading](https://daily.dev/sources/dr)** · 5 min read · 1 upvotes · 0 comments ## Summary Credential theft has become the dominant initial access vector for attackers, with Recorded Future indexing nearly two billion stolen credentials in 2025. The second half of 2025 saw a 50% increase over the first half, driven by industrialized infostealer malware, malware-as-a-service ecosystems, and AI-enabled phishing. Nearly two-thirds of analyzed credentials with identifiable URLs were tied to authentication systems like Okta, Azure AD, or corporate VPNs. Critically, 31% of malware-sourced credentials included active session cookies enabling full MFA bypass. Experts recommend shifting from perimeter and MFA-centric defenses to continuous identity monitoring, phishing-resistant MFA (FIDO2), device-based conditional access policies, and treating high-risk IAM credentials as Tier-0 assets. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Your Next Breach Will Look Like Business as Usual](https://daily.dev/posts/your-next-breach-will-look-like-business-as-usual-ftua7lovf) · Dark Reading · 0 upvotes · 0 comments - [Before the Breach: Identity Persistence Through Stolen Credentials](https://daily.dev/posts/before-the-breach-identity-persistence-through-stolen-credentials-r2rnnzwdf) · Security Boulevard · 0 upvotes · 0 comments - [Credential Stuffing: A Defender’s Guide to Detecting Automated Login Attacks](https://daily.dev/posts/credential-stuffing-a-defender-s-guide-to-detecting-automated-login-attacks-wqhb4uiu9) · Latest Hacking News · 0 upvotes · 0 comments - [Password spraying attacks surge 155x as hackers exploit MFA gaps](https://daily.dev/posts/password-spraying-attacks-surge-155x-as-hackers-exploit-mfa-gaps-itszhorqa) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#iam](https://daily.dev/tags/iam) [View this post on daily.dev](https://daily.dev/posts/more-attackers-are-logging-in-not-breaking-in-9v6pmdhfh) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"More Attackers Are Logging In, Not Breaking In","url":"https://daily.dev/posts/more-attackers-are-logging-in-not-breaking-in-9v6pmdhfh","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/more-attackers-are-logging-in-not-breaking-in-9v6pmdhfh"},"datePublished":"2026-03-17T22:31:38.119Z","dateModified":"2026-03-17T22:32:08.267Z","description":"Credential theft has become the dominant initial access vector for attackers, with Recorded Future indexing nearly two billion stolen credentials in 2025. The...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0c50d332a0ef5bcedb0b1fdbb822c786?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0c50d332a0ef5bcedb0b1fdbb822c786?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Dark Reading","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Dark Reading","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/dr","url":"https://daily.dev/sources/dr"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/more-attackers-are-logging-in-not-breaking-in-9v6pmdhfh","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,iam","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Dark Reading","item":"https://daily.dev/sources/dr"},{"@type":"ListItem","position":3,"name":"More Attackers Are Logging In, Not Breaking In"}]} ```