Enterprise credentials exposed by infostealers

New analysis of 18.7 million infostealer logs carried out by Flare shows a significant rise in enterprise identity compromise. Researchers found that more than one in 10 infections already contained enterprise Single Sign-On (SSO) or Identity Provider (IdP) credentials, and that rate is quickly increasing. In 2025, 2.05 million infostealer logs exposed enterprise identity credentials, providing attackers with potential access to corporate email, cloud infrastructure, SaaS platforms, and internal systems. Preliminary data from late 2025 shows enterprise identity exposure surging to 16 percent of infections, well above model predictions, signaling a shift toward rapid acceleration. “Centralized identity has become the… [Continue Reading]