AI-generated illustration
Research shows that infostealer malware impacted 72% of organizations with exposed login details over a twelve-month period. Cybersecurity company Outpost24 analyzed 31.5 million credentials tied to 4,824 enterprises across the United States and Europe. The findings cover data collected between September 1, 2025, and September 1, 2026.
Scale of Compromised Logins
Breach dumps and shared collections accounted for 30.7 million entries, representing roughly 97% of the total dataset. In contrast, 844,000 credentials originated directly from compromised devices. Although malicious software caused under 3% of total leaks, it affected 41% of organizations through compromised staff email addresses.
Additionally, 31% of the analyzed businesses experienced credential theft limited to customer accounts. Threat intelligence experts noted that active malware poses risks beyond exposed passwords by collecting browser session cookies and stored application logins.
“An infostealer doesn’t stop at one password. It can take session cookies, saved credentials and access to multiple accounts. Resetting a password may close one door while leaving others wide open. Security teams need to investigate the infection, not just the exposed credential.”
Borja Rodriguez, Head of Threat Intelligence at Outpost24
Industry Exposure Variations
Exposure patterns showed sharp differences across economic sectors. Financial Services recorded the highest exposure rate, with 77% of organizations logging at least one credential stolen by infostealer malware. The Consumer Goods and Services sector recorded the largest volume, averaging 498 exposed credentials per business, primarily from consumer records.
Meanwhile, the Business Services sector ranked fourth in overall volume but suffered the highest rate of employee exposure. Approximately 47% of organizations in that category held employee credentials stolen by malicious software, creating distinct enterprise risks in corporate software environments.
Regional Differences and Historic Incidents
Geographic data indicated that typical European organizations held 22% more exposed records than peers in the United States, averaging 224 credentials compared with 184. In Northern Europe, the Nordic region recorded the highest typical volume at 358 credentials. The United Kingdom and Ireland showed the highest proportion stolen by malware, reaching 2.7%.
The study referenced past high-profile breaches to illustrate enterprise vulnerability. Attackers targeted Snowflake customers in 2024 through accounts that lacked multi-factor authentication. In October 2026, META disclosed that intruders accessed internal GitHub repositories after compromising a single employee credential.
Response to Infostealer Malware
Outpost24 advised organizations to focus security responses on devices infected by infostealer malware rather than simple password updates. Security personnel should revoke active browser sessions and inspect endpoints for broader software compromise. For customer accounts, recommended steps include mandatory verification checkpoints, account resets, and targeted fraud monitoring.
