📊 Infostealer Statistics 2026: 47 Verified Facts on Malware Credential Theft
These infostealer statistics for 2026 are compiled from primary-source reports: the Specops Software Breached Password Report 2026, the Microsoft Digital Defense Report 2025, the FBI Internet Crime Complaint Center Annual Report 2025, the IBM Cost of a Data Breach Report 2025, the Verizon Data Breach Investigations Reports (DBIR 2025 and 2026), Constella Intelligence’s 2025 Identity Breach Report, the NordPass Most Common Passwords 2025, and NIST Special Publication 800-63B Revision 4 (finalized July 2025). Each statistic is attributed inline.
Information stealers — malware that silently extracts browser-saved passwords, session cookies, autofill data, and cryptocurrency wallet keys — have shifted from a niche threat to the dominant initial-access tool in cybercrime. Unlike ransomware or phishing, infostealers operate invisibly after a single click, often exfiltrating hundreds of credentials per infected machine before any alert is triggered. The data below documents this shift from four angles: the volume of theft, the malware ecosystem driving it, the financial and operational impact on victims, and what actually stops it.
Key Statistics at a Glance
1. The Scale of Malware-Based Credential Theft
The Specops Software Breached Password Report 2026 is the most comprehensive annual analysis of credentials stolen by malware, drawing on over 6 billion password samples collected from information-stealing malware during 2025. The Constella Intelligence 2025 Identity Breach Report provides independent corroboration of the surge in infostealer activity.
- Information-stealing malware harvested more than 6 billion passwords in 2025, the largest single-year credential haul ever recorded in publicly available security research. (Specops Breached Password Report, 2026)
- The 6 billion figure represents a six-fold increase from the 1.09 billion passwords recorded in Specops’ previous annual edition — the steepest year-over-year rise in the report’s history. (Specops, 2026)
- At 6 billion passwords over 365 days, infostealers were effectively stealing approximately 190 credentials every second, around the clock, throughout 2025. (derived from Specops, 2026)
- 98.5% of the 6 billion stolen passwords were weak by modern standards — defined as fewer than 15 characters or using fewer than two character classes. (Specops, 2026)
- Despite their weakness, 230 million of the stolen passwords still met traditional enterprise complexity requirements (8+ characters, one uppercase, one number, one symbol), demonstrating that complexity rules alone do not prevent mass credential harvesting. (Specops, 2026)
- Constella Intelligence recaptured 51.7 million distinct credential packages from infostealer-related breach data in 2025 — each package typically containing a username, password, and associated service metadata. (Constella Intelligence, 2025)
- Infostealer activity drove a 661% surge in breaches containing personally identifiable information between 2024 and 2025, as PII bundled with credentials became the standard infostealer output format. (Constella Intelligence, 2025)
2. How Stolen Credentials Are Stored and Exposed
A recurring and alarming finding across 2025’s major threat intelligence reports is that infostealers are frequently harvesting credentials that the targeted services stored insecurely — compounding end-user password weakness with server-side failure.
- 68.89% of all breached credentials found in 2025 were stored in plaintext by the services that held them — meaning infostealers needed only to exfiltrate the data, not crack any hash. (Constella Intelligence, 2025)
- Plaintext credential storage represented a 261% increase year-over-year, suggesting that despite years of NIST and PCI-DSS guidance against it, many services — particularly smaller sites — still do not hash or salt stored passwords. (Constella Intelligence, 2025)
- Microsoft observed more than 7,000 password attacks per second against its cloud infrastructure in 2024 — many of which used credential lists compiled from prior infostealer harvests. (Microsoft Digital Defense Report, 2025)
- Identity-based attacks surged 32% in the first half of 2025, with infostealer-derived credential lists cited as a primary driver of the expanded attack surface. (Microsoft MDDR, 2025)
- 85% of usernames targeted in credential-spray attacks already appeared in at least one prior breach dataset — most originally obtained through infostealer campaigns. (Microsoft MDDR, 2025)
3. Key Infostealer Families
The infostealer ecosystem operates as a mature, competitive market. Several malware-as-a-service platforms dominated 2025, with vendors offering subscriptions, support forums, and regular updates. Law enforcement disruptions removed major players but were consistently followed by forks and successor families.
- In October 2024, Europol and international law-enforcement partners dismantled the RedLine Stealer infrastructure in “Operation Magnus,” simultaneously taking down the Meta Stealer variant and seizing back-end servers across multiple jurisdictions. (Europol, October 2024)
- RedLine’s disruption was quickly followed by a surge in LummaC2 (Lumma Stealer) activity, which analysts identified as the dominant infostealer family by sample volume through early and mid 2025. (Microsoft Security Intelligence, 2025)
- In June 2025, Microsoft obtained a court order to seize more than 2,300 domains used by LummaC2 operators to distribute the stealer and receive exfiltrated data. (Microsoft Security Blog, June 2025)
- Prior to the June 2025 disruption, Lumma Stealer was identified in attacks against approximately 394,000 Windows machines between March and May 2025 alone. (Microsoft, 2025)
- LummaC2 was offered as a subscription service at tiered pricing starting around $250/month, enabling technically unsophisticated actors to run large-scale credential-harvesting campaigns. (threat intelligence aggregate, 2025)
- Following the Lumma Stealer action, security researchers observed rapid proliferation of successor variants — including Rhadamanthys, StealC, and Meduza Stealer — filling distribution gaps within weeks. (Recorded Future, 2025)
- Raccoon Stealer, whose original developers were arrested in 2023, continued operating through Raccoon Stealer v2 throughout 2025 under different operators, demonstrating the resilience of MaaS architectures against targeted takedowns. (CISA advisory, 2025)
Source: Specops Software Breached Password Reports 2023–2026. 2025 figure is 5.5× the four prior years combined.
4. What Infostealers Target
Modern infostealers are designed to harvest far more than simple username-and-password pairs. Their target list has expanded to include session tokens, MFA cookies, cryptocurrency wallets, autofill data, and authentication certificates — giving attackers multiple pathways into an account even after a password change.
- Infostealers routinely extract saved browser credentials from all major browsers — Chrome, Firefox, Edge, Brave, and Opera — including passwords stored in the browser’s built-in password manager. (CISA, 2025)
- Beyond passwords, modern infostealers harvest session cookies and authentication tokens, enabling attackers to replay authenticated sessions without knowing the underlying password — a technique that bypasses SMS-based and TOTP-based MFA entirely. (CISA, 2025)
- The average infostealer log contains credentials for between 50 and 200 distinct services per infected machine, reflecting how many browser-saved logins a typical user accumulates over years of browsing. (threat intelligence aggregate, 2025)
- Infostealer logs sold on dark web markets typically include browsing history, installed software lists, system fingerprints, and credit card autofill data alongside credentials — enabling targeted follow-on fraud and phishing. (Recorded Future, 2025)
- The median password appears in the stolen credential set with the same password used across 3 or more distinct services — meaning one infostealer infection can compromise dozens of unrelated accounts simultaneously. (Verizon DBIR, 2025)
- Corporate VPN and privileged access credentials extracted by infostealers sell for the highest prices on dark web markets, often $500 to several thousand dollars per valid set, reflecting their value as initial access for ransomware deployment. (threat intelligence aggregate, 2025)
🔑 Cut the Attack Surface: Use a Dedicated Password Manager
Every infostealer statistic above has one root cause: browser-saved passwords that are easy to extract and widely reused. A dedicated password manager stores your credentials in an encrypted vault that infostealers cannot read through standard browser APIs, and generates unique passwords so one infection does not cascade into dozens of account takeovers.
Try NordPass Free →Sponsored link — we earn a commission at no extra cost to you. See our affiliate disclosure.
5. How Infostealers Are Delivered
Understanding delivery vectors is essential for both individual and enterprise defence. The dominant routes into victim machines in 2025 exploited trust rather than technical vulnerabilities — fake software, poisoned search results, and social engineering rather than unpatched CVEs.
- Malvertising — malicious advertisements served through legitimate ad networks — was the leading infostealer delivery vector in 2025, reaching users searching for popular software downloads via major search engines. (Google Threat Intelligence Group, 2025)
- SEO poisoning (fake software download sites optimised to rank above legitimate sources) was the second most common delivery mechanism, targeting users searching for free versions of commercial software, game mods, and browser extensions. (CISA, 2025)
- Phishing emails with malicious attachments or links remained a primary vector: the Verizon DBIR 2025 found that malware was present in 36% of all phishing-initiated breaches. (Verizon DBIR, 2025)
- Infostealer campaigns increasingly used fake AI tools and AI-assistant installers as lures throughout 2025, exploiting consumer demand for productivity software to deliver LummaC2 and similar stealers. (HP Wolf Security, 2025)
- Fake YouTube tutorials directing viewers to “download links” in descriptions became a high-volume infostealer delivery channel in 2025, with threat actors compromising legitimate creator accounts to host convincing content. (ESET, 2025)
- Game cheats, key generators, and cracked software — distributed through peer-to-peer networks and file-sharing forums — remain among the most consistent infostealer delivery vehicles, targeting younger demographics that represent a growing share of the stolen credential pool. (Kaspersky, 2025)
- AI-generated phishing lures improved infostealer campaign click-through rates significantly in 2025, by enabling personalised, grammatically flawless lures at scale — with the FBI IC3 logging 22,000+ AI-related cybercrime complaints and adjusted losses exceeding $893 million for the year. (FBI IC3, 2025)
6. Financial & Operational Impact
The economic consequences of infostealer-driven credential theft are captured most reliably by the IBM and FBI datasets, which quantify both per-incident costs and aggregate national losses from cybercrime enabled by stolen credentials.
- Breaches where credentials were the initial access method cost an average of $4.67 million per incident — one of the most expensive breach categories in the 2025 IBM study. (IBM Cost of a Data Breach, 2025)
- Credentials were the data type compromised in 53% of all data breaches studied by IBM — the single most targeted class of information across all breach types. (IBM, 2025)
- Credential-based breaches have an average detection-and-containment lifecycle of 246 days — more than eight months of unauthorized access before the breach is identified and closed. (IBM, 2025)
- Breaches lasting more than 200 days cost an average $5.01 million, versus $3.87 million for incidents contained more quickly — a $1.14 million premium for slow detection directly attributable to stealth dwell time. (IBM, 2025)
- US cybercrime losses reached $20.877 billion in 2025 — a 26% single-year increase, with credential theft and account takeover identified as primary contributing categories. (FBI IC3, 2025)
- The FBI IC3 received 1,008,597 complaints in 2025 — the first time in its 25-year history that annual volume exceeded one million, with account takeover formally categorised as a growing distinct threat. (FBI IC3, 2025)
- Account takeover (ATO) fraud generated 5,100+ IC3 complaints and $262 million in direct losses in 2025 — representing only reported cases; the IC3 notes ATO is significantly underreported. (FBI IC3, 2025)
- Despite credential theft remaining ubiquitous, credentials still appear somewhere in 39% of all breach chains in the Verizon DBIR 2026 dataset — across every stage of the attack lifecycle, not just initial access. (Verizon DBIR, 2026)
7. What Stops Infostealer Attacks
Three controls consistently appear in the research as highly effective against infostealer-driven credential compromise: phishing-resistant multi-factor authentication, dedicated password managers that prevent browser credential exposure, and endpoint security tools that detect stealer behaviour before exfiltration completes.
- Phishing-resistant MFA blocks over 99% of identity-based attacks — including those using valid credentials obtained by infostealers — because it requires a hardware-bound cryptographic factor the attacker cannot possess. (Microsoft MDDR, 2025)
- More than 99.9% of accounts that were compromised had no MFA enabled at the time of the attack — a figure consistent across multiple annual Microsoft security reports and the key variable separating protected from unprotected accounts. (Microsoft)
- Only approximately 70% of enterprise users had adopted any form of MFA by 2025, leaving 30% of corporate accounts reliant on the password alone — the precise credential that infostealers are optimised to steal. (survey aggregate, 2025)
- MFA adoption varies sharply by organisation size: 87% of large enterprises use MFA, while only about 34% of small businesses have deployed any second factor — meaning SMBs are dramatically over-represented in infostealer victim pools. (enterprise security survey, 2025)
- Session-cookie hijacking bypasses SMS and TOTP MFA entirely — only FIDO2-based (hardware key or passkey) authentication, which binds authentication to the registered origin, is resistant to replay of stolen session tokens. (CISA, 2025)
- NIST SP 800-63B Revision 4, finalized July 2025, explicitly requires all new passwords to be screened against compromised-credential databases at the point of creation — a direct mitigation against infostealer-derived credential reuse. (NIST SP 800-63B-4, 2025)
- NIST SP 800-63B-4 prohibits mandatory periodic password expiration — changing passwords on schedule does not reduce infostealer risk; changing immediately after a compromise is detected does. (NIST SP 800-63B-4, 2025)
🔑 The Practical Step: Use a Password Manager
The statistics above make the root cause clear: browser-saved passwords are the primary target of infostealer malware, and reused passwords turn every infection into dozens of account takeovers. A dedicated password manager keeps credentials in an encrypted vault, generates a unique password for every account, and alerts you when a saved password appears in a known breach.
Try NordPass Free →Sponsored link — we earn a commission at no extra cost to you. See our affiliate disclosure.
Frequently Asked Questions
How many passwords were stolen by infostealers in 2025?
According to Specops Software’s Breached Password Report 2026, information-stealing malware harvested more than 6 billion passwords in 2025 — a six-fold increase from the 1.09 billion recorded in the previous annual edition. This equates to approximately 190 credentials stolen every second throughout the year.
What is the most dangerous infostealer in 2025?
LummaC2 (Lumma Stealer) emerged as the dominant infostealer family by sample volume after Europol’s October 2024 Operation Magnus disrupted RedLine Stealer. Microsoft identified Lumma in attacks against approximately 394,000 Windows machines between March and May 2025, before seizing 2,300+ malicious domains in June 2025. After Lumma’s disruption, Rhadamanthys, StealC, and Meduza Stealer filled the gap within weeks.
How do infostealers bypass multi-factor authentication?
Modern infostealers target session cookies and authentication tokens stored in browsers in addition to passwords. When an attacker replays a valid session cookie, no password or MFA challenge is presented — the server sees a legitimate authenticated session. This technique bypasses SMS-based 2FA and authenticator app TOTP codes entirely. Only FIDO2 phishing-resistant MFA (hardware security keys or device passkeys) is resistant to cookie replay, because authentication is cryptographically bound to the registered origin. (CISA, 2025)
What is the financial cost of infostealer-driven credential theft?
The IBM Cost of a Data Breach Report 2025 puts credential-based breach costs at an average of $4.67 million per incident, with a 246-day average detection lifecycle. At the national level, the FBI IC3 2025 Annual Report logged $20.877 billion in total cybercrime losses — a 26% single-year increase — with account takeover fraud alone generating $262 million in confirmed direct losses from 5,100+ reported cases.
Does a password manager protect against infostealers?
A dedicated password manager significantly reduces infostealer exposure in two ways. First, credentials stored in an encrypted vault rather than the browser’s built-in save function are not accessible through the browser’s standard credential APIs that infostealers target. Second, because a password manager generates a unique password for every account, one infected device does not cascade into account takeovers across dozens of services. However, no single tool is a complete defence: pairing a password manager with phishing-resistant MFA (FIDO2/passkey) closes the session-cookie bypass gap that passwords alone cannot address.
