2.86 Billion Credentials Flood Criminal Markets — How Infostealers and Initial-Access Brokers Are Reshaping Risk

Stolen login data has become a commodity so abundant that it’s now cheap to buy in bulk — and alarmingly effective when attackers use it to pivot into corporate environments. In 2025, researchers reported roughly 2.86 billion compromised credentials traded across underground markets. That scale changes the calculus of identity: a correct username and password no longer prove much when attackers can acquire massive volumes of records, cookies, and browser data that let them impersonate legitimate sessions.

A market tuned for scale — and for premium access

Stolen data sits on a spectrum. On the commodity end, single data points sell for pocket change: Social Security numbers for $1–$6, simple name-and-email records for under $15, full identity packages for about $20–$100, and payment cards with CVV for roughly $10–$40. Bulk dumps like these are useful for credential stuffing, account takeover attempts, and wide-reaching fraud campaigns because attackers can cheaply test credentials across many services.

At the other end, the underground rewards immediacy and actionability. Verified access to business networks and cloud environments commands much higher prices: reports show average initial-access-broker listings climbed from about $2,726 in 2024 to some headline averages of $113,275 in 2025 — a dramatic increase heavily influenced by a few listings claiming access to very large, high-revenue targets. Typical access costs more modest sums, but the trend reveals an ultra-premium tier where direct entry into large organizations is extremely valuable.

Cookies, session replay, and why MFA isn’t a silver bullet

Attackers are not just after passwords. Session cookies and browser tokens that keep users signed in are traded at a premium because they can let an attacker “replay” an authenticated session and bypass repeated login prompts — including some forms of multi-factor authentication (MFA). Infostealer malware, often delivered by phishing, fake updates, pirated software or malicious attachments, harvests browser-stored credentials, cookies, and session tokens that facilitate this kind of session hijacking.

This does not mean MFA has failed, but it highlights that authentication must protect the session lifecycle, not only the moment of sign-in. Shorter session lifetimes, binding sessions to specific devices, and detecting session replay are practical mitigations. Moving toward phishing-resistant MFA (e.g., hardware tokens, FIDO2) and continuous verification reduces the value of cookies and ephemeral tokens attackers attempt to monetize.

Why enterprise defenders should pay attention now

The growing trade in initial-access listings and the rise of AI to curate targeted dumps both change how defenders should prioritize risk. AI-curated records tailored to specific companies or roles command premiums because they enable more convincing, targeted phishing and faster, more effective intrusions. Healthcare and finance remain attractive targets — healthcare records sell higher because they can’t be easily reissued, often fetching $250–$310 apiece — but any organization with valuable cloud assets or weakly segmented networks is at risk.

Practical hardening steps that matter

Harden authentication and sessions: Implement phishing-resistant MFA, reduce session lifetimes where feasible, bind sessions to device profiles, and require reauthentication for sensitive operations.
Monitor for session replay and token abuse: Look for anomalies consistent with cookie reuse, such as geographic or device changes mid-session, and instrument systems to detect session anomalies.
Reduce the value of harvested data: Limit storage of long-lived tokens in browsers, apply strict cookie policies, and minimize the attack surface where infostealers can harvest credentials.
Prioritize reviews after exposures: Any credential exposure — even seemingly low-value leaks — should trigger checks for privileged account access, internet-exposed services, and internal movement detection. Initial access brokers often monetize even small footholds, so rapid containment matters.
Use threat intelligence and exposure monitoring: Combine dark-web price and listing signals with internal telemetry to focus incident response and patching on the most-likely attacker pathways.

Conclusion

Cheap stolen data still leads to costly compromises. The underground economy is bifurcating: mass-produced credential dumps fuel wide-scale fraud, while high-value, verified access listings and session tokens drive targeted enterprise intrusions. Defenders should treat market signals as a form of threat telemetry, harden both authentication and session management, and prioritize visibility into internet-facing systems and lateral-movement controls. Stopping phishing and infostealer campaigns before they harvest credentials remains one of the most effective ways to blunt this market-driven threat.