Flare Analysis Maps Underground Market for Targeted Stolen Credentials
Summary
Flare analyzed 470 underground forum posts describing services that search infostealer-derived credential collections for target-specific results. Buyer feedback cited invalid or duplicated credentials; defenders are advised to monitor exposures and secure affected logi
Key points
- Flare analyzed 470 underground forum posts published from January 2025 to June 2026 about services that search stolen-credential databases for buyer-specified targets.
- The services act as processing brokers, filtering and formatting infostealer-derived credentials for targets such as company domains, platforms, and email lists.
- The article describes a workflow in which infostealers collect credentials and browser data, sellers search aggregated collections, and buyers may use results for account takeover or other fraud.
- Buyer feedback in the dataset described credentials as invalid, duplicated, or similar to data available in free combo lists; the article does not establish that advertised records are valid.
- The market can overlap with initial access brokering when searches return credentials for corporate services, but the article distinguishes these results from validated access sold by IABs.
- Recommended defenses include monitoring exposed employee credentials and access points, resetting passwords, revoking sessions, enforcing MFA, and investigating possible account misuse.
Article Details
- Publisher
- BleepingComputer (sponsored content written by Flare)
- Report Period
- January 2025–June 2026
- Scope
- Underground credential-search services, based on forum posts across different sources.
- Sample Size
- 470 underground forum posts
- Key Statistics
- One seller advertised a database of 5 billion lines and claimed access within 10–15 minutes with daily updates.
- Another seller advertised a database of more than 10 billion lines and over 1 TB.
- One seller advertised searches for $20 per request, with additional payment based on results.
- A buyer reportedly claimed that only 200 of 3,000 records were unique.
- Recommendations
- Monitor exposed employee credentials, corporate domains, login portals, and SaaS applications in underground sources.
- Prioritize relevant exposures and respond with password resets, session revocation, and MFA enforcement.
- Investigate possible account misuse when exposed credentials are identified.