A new benchmark report from Outpost24 has found that infostealer malware played a role in nearly three-quarters of corporate credential exposures over the past year, even though the malware itself directly accounts for only a sliver of the stolen logins involved.
Key Takeaways
- Outpost24’s 2026 Credential Exposure Benchmark Report tracked 31.5 million exposed credentials linked to 4,824 organisations across five industries in the US and Europe.
- 72% of those organisations had staff or customer credentials turn up in infostealer malware logs, even though such malware directly caused under 3% of the exposures.
- Financial Services had the highest share of organisations hit by infostealer-sourced credentials (77%), while Consumer Goods and Services had the highest total exposure, at 498 credentials per typical organisation.
A small slice of stolen data, a wide reach
Outpost24 researchers analysed 31.5 million unique exposed credentials linked to 4,824 organisations across five industries in the US and Europe, first detected between September 2025 and September 2026. Of those organisations, 72% had staff or customer credentials identified in infostealer malware logs, which harvest login details, session cookies and other data directly from an infected device.
Most of the exposed credentials did not come from that malware at all. Around 30.7 million, roughly 97%, came from breach dumps and combolists, the large collections of leaked logins that criminals compile and trade. The remaining 844,000, under 3%, were taken directly from infected devices by infostealers, and are far more likely to reflect recent theft. Among the organisations studied, 41% had at least one infostealer-sourced credential on a staff email address, pointing to malware on a device used for work, while a further 31% had malware-stolen credentials only on customer accounts.
“Less than 3% of exposed credentials came directly from infostealer logs, yet nearly three-quarters of organisations were affected. That tells us why counting stolen passwords isn’t enough. An infostealer doesn’t stop at one password. It can take session cookies, saved credentials and access to multiple accounts. Resetting a password may close one door while leaving others wide open. Security teams need to investigate the infection, not just the exposed credential,” said Borja Rodriguez, Head of Threat Intelligence at Outpost24.
The risk isn’t where the numbers are biggest
Exposure varied far more by industry than by location. Consumer Goods and Services had the most exposed credentials of any sector, 498 at the typical organisation, almost all belonging to customers. Business Services ranked only fourth on total credentials but first on staff exposure, with 47% of its organisations holding a malware-stolen staff credential. Financial Services had the highest share of organisations with at least one infostealer-sourced credential, at 77%.
Geography mattered less, though it was not even across Europe. The typical European organisation had 224 exposed credentials against 184 for its US counterpart, 22% more, with a similar malware-stolen share in both. Within Europe, the Nordics had the highest exposure, at 358 credentials at the typical organisation, while the UK and Ireland had the highest share stolen specifically by malware, at 2.7%. Spain had the lowest exposure, at 133 credentials at the typical organisation. The steepest combination of industry and region was Consumer Goods and Services in Benelux, at 1,285 credentials for the typical organisation.
“The company with the most exposed credentials isn’t necessarily the one with the greatest threat to its own systems. Thousands of stolen customer logins tell a very different story from a handful of compromised employee accounts. One points primarily to account takeover and fraud; the other could give attackers a foothold inside the business. Security teams need to know whose credentials were stolen, not just how many,” Rodriguez added.
Echoes of Snowflake and Meta
The report points to two recent cases as a reminder of what a single stolen credential can lead to. In 2024, attackers used stolen credentials to log into Snowflake customer accounts that had no multi-factor authentication enabled. More recently, Meta disclosed in October 2026 that attackers had reached some of its GitHub repositories using one employee’s stolen credentials.
Outpost24’s recommendation is to treat infostealer-sourced credentials differently from the rest. For staff credentials, it advises security teams to investigate the associated user and device, check whether other passwords or session cookies were stolen, and revoke active sessions rather than simply issuing a new password. For customer credentials, it recommends securing the affected accounts through password resets, additional verification and fraud monitoring. The full report is available on Outpost24’s website.
