Hackers Don't Break In Anymore. They Log In.
There's a line from the security research community that cuts through the noise better than any statistic:
"Hackers no longer force open the side-window when infostealers can give them a key to the front door."
In 2025, that key was handed out 11.1 million times.
The Scale of the Problem
SecurityWeek's analysis of 2025 infostealer activity puts numbers to what security professionals have been warning about for years:
-11.1 million devices infected with infostealer malware in 2025
-3.3 billion credentials, browser artifacts, and session tokens now circulating in criminal marketplaces
To put that in context: 3.3 billion credential sets means the average person's login information has been stolen, packaged, and listed for sale multiple times over. The question is no longer whether your credentials are out there. It's whether anyone has used them yet.
Anyone Can Buy This For Less Than a Netflix Subscription.
What changed over the last three years isn't the sophistication of attackers. It's the accessibility of their tools.
Infostealer malware is now sold as a subscription service. Malware-as-a-Service (MaaS) packages give anyone with a browser and a credit card access to credential theft infrastructure starting at $60 per month. More capable variants like OnyxC2 run $250 per month.
For $60 a month, less than most people spend on streaming services, an attacker gets:
-A fully functional stealer that harvests every saved password from Chrome, Safari, and Firefox
-Active session cookies that bypass 2FA entirely
-VPN, RDP, and remote access credentials
-Cryptocurrency wallet keys and seed phrases
-Credit card data stored in browsers
-Cloud platform credentials (AWS, Azure, Google Cloud)
-System metadata for targeting
The stolen data is packaged into a "log" and sent to a command-and-control server within minutes. That log is then listed on criminal marketplaces, typically within 24–72 hours of infection.
The Malware Families Behind 11 Million Infections
The five most active infostealer families in 2025:
Lumma: the most prolific; distributed via fake software downloads, cracked games, and malicious YouTube tutorials
Acreed: fast-growing, targeting corporate credentials specifically
Rhadamanthys: advanced evasion capabilities, favored for targeting high-value individuals
Vidar: resurgent; by early 2026 accounted for over 73% of infected hosts, up from a minor player in 2025
StealC: lightweight, modular, widely distributed via phishing campaigns
The 2026 shift is notable. Lumma dropped from dominant to just 1.1% of infections as Vidar surged to 73%. This isn't a sign the threat is shrinking. It's a sign the criminal ecosystem is actively evolving and switching tools to evade evasion.
Why This Is the Ransomware Problem You Didn't Know You Had
Credential theft via infostealer isn't just an account takeover problem. It's increasingly the first stage of ransomware deployment.
The attack chain:
Employee clicks a malicious link or downloads infected software
Infostealer silently exfiltrates all credentials from the device
Attacker uses stolen VPN or RDP credentials to access the company network legitimately, as a logged-in user
Ransomware deployed from inside the perimeter, days or weeks later
By the time the ransomware fires, the attacker has been inside the network with valid credentials for long enough to map the environment, identify backups and maximize damage. The infostealer is the reconnaissance and access tool. The ransomware is the conclusion.
For small businesses, this matters because ransomware recovery costs dwarf the cost of prevention. The average SMB ransomware incident costs $200,000–$500,000 in downtime, recovery, and reputational damage, often enough to close a business permanently.
What You're Actually Up Against
The delivery method is almost always social engineering, a fake software update, a convincing phishing email, a malicious ad for a tool you actually use. The infection itself takes seconds. The credential harvest takes minutes. The damage can take years to fully understand.
The 24–72 hour window between infection and log publication in criminal markets is the only actionable gap that exists. After that, your credentials are in the hands of anyone willing to pay for them and you have no way of knowing who that is or what they're doing with them.
RelayShield monitors your email addresses against infostealer log markets in near real-time. If your device credentials appear in a criminal channel, you get an alert within hours with four specific remediation steps to contain the damage before session replay, password resets and account takeovers begin.
The $60/month the attacker spent to get your credentials takes minutes to act on. The monitoring that catches it costs less.
Source: SecurityWeek — "Infostealers Turn Millions of Devices Into Credential Theft Machines"
🛡️ RelayShield — real-time identity monitoring via WhatsApp and Telegram. relayshield.net
