Threat actors are logging in
Once criminals have established access to systems, they rarely make an immediately obvious move, says Caesar Tonkin, MD of Armata Cyber Security.
In June 2025, a whopping 16 billion login credentials were exposed across major platforms including Apple, Google, and Facebook. By 2026, the IBM X-Force Threat Intelligence Index reported that 300,000 AI chatbot credentials were for sale on the dark web. South African stolen credentials fetch incredibly low prices, as low as R100.
Corporate credentials command a higher price. These illicit credentials are fueling the surge in data-theft attacks and dark web subscription services profiting from the stolen information. Sensitive data, high-risk user credentials, social media account details, credit card information, and hacked logins are all sought-after commodities on the dark web.
High-risk targets, such as technical leads, finance directors, and C-suite executives, pose the greatest threat due to their access to multiple connected systems. Centralized identity platforms like Microsoft Entra ID, Okta, and AWS IAM Identity Center streamline enterprise access, making compromised credentials exponentially more valuable.
High-risk users are also prime targets for social engineering tactics. They may unknowingly fall victim to bad actors impersonating colleagues in unauthorized online communities. Once inside, threat actors often remain undetected for extended periods, using legitimate tools like PowerShell, WMI, and Remote Desktop Protocol to avoid triggering anomaly detection.
It is possible for attackers to maintain a presence within an organization for up to four years, harvesting data before launching a major attack. Early detection is crucial, as it can save businesses up to $1.8 million per breach. Security solutions now offer continuous scans to identify credentials on the dark web, sensitive data in criminal forums, high-risk users in threat actor communities, and credential reuse indicating serious vulnerabilities.
These scans provide valuable insights, allowing organizations to protect and prevent attacks before they occur. By identifying compromised credentials, organizations can engage high-risk users in meaningful conversations about improved credential management and security awareness. This proactive approach not only enhances security but also fosters a culture of vigilance among high-profile users.
In South Africa, companies face approximately 1,800 attacks per month, many of which involve stolen credentials already available on the dark web. Ultimately, the question remains: will your security company or the threat actor detect your vulnerabilities first?
Written by urgent.news from ITWeb's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
