SpyCloud report forecasts identity-driven cybercrime trends for 2026
Summary
SpyCloud’s report reviews 2025 identity-threat trends and forecasts more commoditized identity attacks, identity sprawl, insider and supply-chain risks, AI-enabled fraud, and evolving MFA bypasses in 2026. It includes exposure and survey findings.
Key points
- SpyCloud reports that corporate users averaged 146 exposed identity data records—12 times more than previous tracking methods reported.
- SpyCloud says 56% of organizations experienced an insider-threat incident in the previous year.
- Its 2025 Annual Identity Exposure Report recorded about 900,000 stolen credential records obtained from enterprise AI tools.
- SpyCloud says session hijacking was the third most common ransomware entry point in 2025; its recaptured database analysis found 66% of malware infections bypassed EDR or antivirus.
- Citing Verizon research, the report says third-party involvement was observed in 30% of breaches in 2025.
- For 2026, SpyCloud forecasts continued growth in commoditized identity attacks, non-human identity exposure, AI-assisted phishing and fraud, and supply-chain compromise.
- The report warns that prominent “megabreach” or combolist stories may recirculate data from older breaches or infostealer logs rather than indicate a new breach.
Article Details
- Publisher
- SpyCloud
- Report Period
- 2025 lessons and 2026 projections
- Scope
- SpyCloud observations of identity exposure and threat trends in 2025, with projections for 2026.
- Key Statistics
- SpyCloud reports that corporate users had an average of 146 exposed identity data records, or 12 times more than previous tracking methods reported.
- 56% of organizations experienced an insider threat incident in the past year, according to SpyCloud research.
- About 92% of organizations surveyed felt that AI-powered cybercrime creates intensified risk.
- SpyCloud reports that 66% of malware infections in its recaptured database analysis bypassed EDR or antivirus solutions.
- Verizon research cited in the report found third-party involvement in 30% of breaches in 2025.
- Recommendations
- Monitor users’ holistic identities across organizational and personal accounts, and remediate exposed identity data.
- Apply strong vetting and risk controls to non-human identities, vendors, contractors, and other third parties; use continuous vendor monitoring, contractual safeguards, Zero Trust access management, and joint incident response plans.
- Update security policies and employee training to address increasingly convincing suspicious communications.
- Prioritize detection and remediation because malware and stolen session cookies can evade existing defenses.
- Strengthen identity verification and fraud prevention to identify suspicious accounts and potential synthetic identities.
MITRE ATT&CK
T1539 · Steal Web Session CookieThe report describes attackers using stolen session cookies to hijack authenticated users’ sessions.T1557 · Adversary-in-the-MiddleThe report identifies Adversary-in-the-Middle attacks used to phish credentials and steal valid cookies.T1566 · PhishingThe report discusses phishing campaigns and phishing kits used to deceive users and obtain sensitive information.T1621 · Multi-Factor Authentication Request GenerationThe report describes mass notification services being used to spam MFA approval requests.
People
Aurora JohnsonManager of Security Research Partnerships at SpyCloud; commented on insider threats and AI-enabled phishing.Damon FleurySpyCloud’s Chief Product Officer; commented on malware evading endpoint defenses and stolen session cookies.Joe RoosenDirector of Security Research at SpyCloud; commented on contractor security, synthetic identities, and exposed data.Trevor HilligossHead of Security Research and SVP of SpyCloud Labs; commented on stolen non-human identities and security controls.
Threat Actors
Malware
Vendors
Tools
Asgard Protector- Malware crypting services used to evade antivirus software (ex. Asgard Protector)GhostSocksPopular infostealer malware like LummaC2 and its collaboration with the GhostSocks residential proxy led the charge in 2025, and a plethora of other packaged offerings, from crypting services, to install brokers andLinken Sphere- “Anonymity” or antidetect browsers (ex. Linken Sphere, MultiLogin) used to bypass device fingerprintingMultiLogin- “Anonymity” or antidetect browsers (ex. Linken Sphere, MultiLogin) used to bypass device fingerprintingTycoon 2FAThis is commonly powered by infostealer technology and phishing kits, such as Tycoon 2FA, which are surging in popularity and projected to keep spreading in 2026.
Countries
Industries
BankingWe’re banking on these stories as some of the major threads to follow and be proactive about where possible for business leaders and IT decision-makers.Federal governmentHeavily-regulated sectors like the federal government, financial services, and insurance industry are on the other end of the storm scale, with lower threat gravity due to their heavy investment in supply chainFinancial ServicesHeavily-regulated sectors like the federal government, financial services, and insurance industry are on the other end of the storm scale, with lower threat gravity due to their heavy investment in supply chainInsuranceHeavily-regulated sectors like the federal government, financial services, and insurance industry are on the other end of the storm scale, with lower threat gravity due to their heavy investment in supply chainITWhy, it’s identity misuse of course.SoftwareCybercrime is a booming industry worldwide, and attack methods are being commercialized by and for threat actors much like corporate software models for traditional businesses (i.e.TelecommunicationsOur 2025 Identity Threat Index found that the IT, telecom, and software industries face 4-6x higher threat levels than others with regard to possible identity exposures creating pathways into partner networks.