Skip to content
Credential Exposure Threats Surge: 66% of Infected Devices Had Security Tools

Credential Exposure Threats Surge: 66% of Infected Devices Had Security Tools

First seen 17 Oct 2026, 16:47 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 17, 2026 at 18:20 UTC
  • •66% of infected devices had security tools installed, indicating vulnerabilities.
  • •SpyCloud reports a 23% increase in identity records circulating underground.
  • •85% of organizations with identity tools still suffered breaches, highlighting response gaps.

Recent reports indicate a significant increase in credential exposure due to infostealer malware, with 66% of infected devices having security tools installed. SpyCloud's 2026 Identity Exposure Report reveals 65.7 billion distinct identity records circulating underground, marking a 23% rise from the previous year. The report highlights that non-human identity (NHI) exposure has expanded, affecting cloud infrastructure and AI services. Despite the deployment of identity tools, 85% of organizations still experienced breaches, as noted in the SANS 2026 ITDR Report. The report emphasizes that while 68% of organizations detect identity attacks within 24 hours, only 55% manage to contain them in that timeframe. This indicates a gap in response capabilities despite the presence of detection tools. The findings underscore the need for improved credential management and rapid response strategies to mitigate these threats.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-16
SpyCloud's 2026 Identity Exposure Report released
The report revealed 65.7 billion identity records in circulation, a 23% increase from last year.
Aws.Amazon
2026-10-16
SANS 2026 ITDR Report published
The report found that 85% of organizations with identity tools still experienced breaches, revealing significant response issues.
www.sans.org

More articles in this cluster (5)

Following this threat?

Track Raccoon in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (7)

1 / 4

Common questions

What is the scale of credential exposure?
SpyCloud reports 65.7 billion distinct identity records are currently circulating underground.
Why are organizations still experiencing breaches?
Despite deploying identity tools, many organizations lack the capability to effectively respond to detected attacks.
What can organizations do to improve their response?
Organizations should enhance their credential management practices and improve incident response strategies to mitigate risks.