Almost half of enterprise apps don't handle credentials securely
A new report from Orchid Security shows nearly half of enterprise applications violate basic credential-handling guidance, with 44 percent undermining centralized identity provider (IdP) policies and 40 percent falling short of widely accepted identity-control standards.
Orchid analyzed authentication flows and authorization practices embedded deep within enterprise applications and finds clear-text credentials in nearly half. These are normally associated with alternative access flows, often for non-human accounts, but they also present an easy target for threat actors seeking entry or lateral movement.
Credential theft escalates as threat actors use stealthier tactics
Cybercriminals are pivoting to stealthier tactics, with lower-profile credential theft spiking, while ransomware attacks on enterprises have declined.
These are among the findings of a new report from IBM X-Force which also observes an 84 percent increase in emails delivering infostealers in 2024 compared to the previous year, a method threat actors rely heavily on to scale identity attacks.
Number of compromised credentials up by 33 percent
The latest Global Threat Intelligence Report (GTIR) from Flashpoint finds that threat actors compromised over 3.2 billion credentials in 2024, a 33 percent increase from the year before.
Of these 75 percent or 2.1 billion, were sourced from information stealing malware, a dangerous new twist on an older threat that has infected over 23 million devices worldwide.
70 percent of leaked credentials remain active two years on
A new report shows 70 percent of secrets leaked in 2022 remain active today, creating an expanding attack surface that grows more dangerous with each passing day.
The study from GitGuardian also reveals a 25 percent increase in leaked secrets year-on-year, with 23.8 million new credentials detected on public GitHub in 2024 alone.
Credential phishing attacks up over 700 percent
Phishing remains one of the most significant cyber threats impacting organizations worldwide and a new report shows credential theft attacks surged dramatically in the second half of 2024, rising by 703 percent.
The report from SlashNext shows that overall, email-based threats rose by 202 percent over the same period, with individual users receiving at least one advanced phishing link per week capable of bypassing traditional network security controls.
New Dashlane tool warns of compromised credentials
Leaked or stolen credentials remain a major cause of security breaches and reuse of passwords between accounts only compounds the problem.
Password manager company Dashlane is launching new automated tool to empower admins to proactively create a more security-conscious workforce and drive better credential security behavior across their organization, reducing the risk of credential theft.
The phishing bait you're most likely to take
Phishing is the most common form of cyberattack as criminals seek to obtain credentials to access bank accounts or corporate networks.
Abnormal Security has analyzed which phishing attacks generate the highest click rate and categorized them based on the words included in the subject line.
Stolen credentials and the rise of the 'traffers'
Even as we move towards passwordless authentication methods, stolen credentials remain a major problem for businesses.
A new report from cyber risk management company Outpost24 highlights the increasing professionalization of the market for stolen credentials thanks to the rise of what are known as 'traffers'.
