There is a new warning that the cybercrime economy has been “fully industrialised” with infostealing now an increasing factor in online crime.

The issue has been highlighted in a new report, released today by cyber experts on information-stealing malware (infostealers) by cyber experts Flashpoint, who revealed this year alone, the company has identified over 1.8 billion stolen credentials circulating across illicit marketplaces, fueling identity-based attacks at an incredible and still growing scale.

The company said over the past year and a half, it has observed an “alarming surge” in information-stealing malware.

It added many recent high-profile breaches were the direct result of infostealer infections on a corporate or personal device permitted to access company resources.

Designed to collect a wide range of information, ranging from IP addresses, operating systems, usernames, installed applications, cookies, autofill data, and more, infostealers have gained massive popularity among cybercriminals due to their low cost, accessibility, and ability to provide deeper access than many other initial access vectors.

The company added Flashpoint’s latest Global Threat Intelligence Index revealed that infostealer-driven credential theft has skyrocketed by 800% since the start of 2025.

Josh Lefkowitz, Flashpoint CEO and Co-Founder said: “The rise of Malware-as-a-Service (MaaS) has fully industrialised the cybercrime economy, making infostealers the most scalable entry point for enterprise attacks in 2025. As organisations plan their 2026 defense strategies, defending against this trend requires a direct, unmediated view into the illicit underground where these logs are being weaponized. Acquiring this level of visibility necessitates Primary Source Collection (PSC).”

The company’s new report added: “A wave of breaches targeting multiple US companies across various sectors permanently changed how organisations viewed their threat landscapes. The source of the devastation was a single, deceptively simple attack: threat actors used stolen credentials from a former employee to quietly gain access to multiple victim instances, move laterally within the network, and steal sensitive data from over 100 customer accounts.

“Within days, Flashpoint’s collections found the stolen data being listed for sale across multiple illicit marketplaces. In the following months, these compromised companies endured reputational damage, legal fallout, and millions in financial losses.”

It added: These breaches were more than a one-off incident; they served as a wake-up call, marking the beginning of large-scale information-stealing malware campaigns. Since then, “infostealers” have surged across the threat landscape, facilitating identity-based attacks at unprecedented scale. This year alone, Flashpoint has observed a dramatic rise in stolen credentials – with infostealers being responsible for the theft of over 1.8 billion corporate and personal email accounts, passwords, cookies, and other sensitive data.

“The challenge for security teams is that defending against infostealers requires more than just knowing a breach occurred; it requires visibility into the illicit marketplaces where these stolen logs are bought, sold, and weaponised.”

Ian Gray, Flashpoint VP of Intelligence concluded: “Data theft tools known as infostealers have facilitated massive-scale compromises of user credentials and session tokens. The output files from these infections, called infostealer logs, have transformed such attacks into a pathway for gaining corporate network access and launching subsequent operations. A single log file can capture enough host and session information to enable attackers to move laterally through systems and achieve complete network compromise. Given the 800 percent surge in infostealer infections during 2025, defensive strategies must shift toward proactive monitoring of stolen session cookies and corporate device metadata—eliminating the risk before attackers can orchestrate a full network breach.”