3/18/26
A recent article is packed with data showing that attackers are no longer breaking in—they’re logging in. 2025 threat data show nearly 2 billion stolen credentials circulating, with a sharp surge driven by infostealer malware, malware-as-a-service, and AI-enabled phishing. More concerning, attackers are targeting identity control planes (Okta, Azure AD, VPNs), and 31% of stolen credentials include session cookies, allowing MFA bypass and seamless account takeover.
Security leaders need to be aware that identity is now itself a primary attack surface and that traditional controls of perimeter defenses and even MFA are no longer sufficient on their own.
Additional mitigating controls include:
🔹 Move from access control only monitoring to continuous identity monitoring and response
🔹 Prioritize phishing-resistant MFA (e.g., FIDO2), behavioral-based access controls and other Conditional Access factors such as device posture
🔹 Treat identity systems as Tier-0 assets
🔹 Assume credential compromise and design for real-time detection and rapid containment