Flashpoint Report Highlights AI-Driven Threats, Infostealers and Ransomware Trends

Summary

Flashpoint’s 2026 report cites 11.1 million infostealer-infected machines, 3.3 billion stolen credentials, 44,509 vulnerabilities and an 8,835-case ransomware total for 2025, with AI-driven threats and identity abuse among its key concerns.

Key points

Flashpoint reported a 1,500% rise in AI-related illicit discussions between November and December 2025 and described attackers’ use of AI to automate attack-chain activity.
The report says infostealers infected more than 11.1 million machines in 2025, producing over 3.3 billion stolen credentials; Vidar 2.0 became the most-used infostealer after Lumma’s May 2025 takedown.
Flashpoint recorded 44,509 vulnerabilities in 2025, including 14,593 with publicly available exploits, and highlighted vulnerabilities affecting AI and development tools.
The report counted 8,835 ransomware attacks in 2025, a 53% year-over-year increase; ransomware-as-a-service groups were attributed over 87% of attacks.
Manufacturing was the most targeted industry in the report’s ransomware data, and the United States was the most affected country.
Flashpoint describes ransomware groups shifting toward social engineering, identity abuse and extortion, and reports 91,321 instances of insider recruiting and illicit activity in 2025.
Recommended priorities include monitoring compromised credentials and insider threats, hardening human and machine identities, and prioritizing remotely exploitable vulnerabilities with public exploits.

Article Details

Publisher: Flashpoint
Report Period: 2025 data; report published in 2026
Scope: Global threat intelligence covering AI threats, infostealers, vulnerabilities, and ransomware.
Sample Size: Not disclosed
Key Statistics: Flashpoint identified a 1,500% rise in AI-related illicit discussions between November and December 2025.
Flashpoint observed over 11.1 million machines infected with infostealers in 2025, resulting in over 3.3 billion stolen credentials.
Flashpoint recorded 44,509 vulnerabilities in 2025; 14,593 had publicly available exploits.
Flashpoint observed 8,835 ransomware attacks in 2025, a 53% year-over-year increase; RaaS groups were responsible for over 87% of attacks.
Manufacturing was the top targeted industry for ransomware in 2025, with 1,564 attacks.
Recommendations: Prioritize vulnerabilities that have a known solution, are remotely exploitable, and have a publicly available exploit.
Audit the security of agentic AI dependencies and monitor processes connecting AI agents to production environments.
Continuously monitor for compromised credentials and potential malicious insiders.
Expand ransomware defenses beyond encryption protection and harden the Help Desk as a security gate.