Listen to this Post
Introduction: Why 2025 Marked a Turning Point for Account Compromise
The global cyber threat landscape in 2025 shifted decisively toward one core objective: stealing credentials at scale. Instead of relying primarily on noisy malware campaigns, threat actors increasingly chose quieter, more efficient paths into corporate environments by abusing legitimate login details. New data from eSentire’s 2025 Year in Review & 2026 Threat Landscape Outlook Report paints a clear picture of an ecosystem where identity is the new perimeter, and where access, not exploitation, is the fastest route to profit. The report reveals how phishing-as-a-service platforms, business email compromise tactics, and cloud account abuse converged into a mature, highly industrialized attack economy.
Summary of the Original Report
The eSentire report shows that cyber threat actors dramatically intensified credential theft operations in 2025, with a staggering 389% year-over-year increase in account compromise incidents. These incidents accounted for 55% of all attacks observed by the cybersecurity firm, marking credential abuse as the dominant threat vector of the year. According to eSentire’s Threat Response Unit, credential access represented 75% of all malicious activity seen in the wild, underscoring how attackers increasingly prioritize identity-based access over traditional malware-heavy intrusion techniques.
Two-thirds of credential theft activity was aimed directly at account takeovers, while the remaining third supported large-scale phishing operations. Microsoft 365 accounts emerged as the most frequently targeted assets, reflecting the central role cloud-based productivity platforms now play in enterprise operations. Although malware remained a significant threat category, accounting for 25% of observed activity, its prevalence declined by four percentage points compared to 2024, signaling a strategic shift rather than a reduction in attacker capability.
The report highlights that the use of valid credentials to spread email-based malicious campaigns became the leading initial access vector across more than 2,000 eSentire customers. This method rose from 37% to 55% of total security incidents in a single year. Much of this growth was driven by phishing-as-a-service ecosystems, which were responsible for 63% of all account compromise incidents recorded during the period.
Specific PhaaS operations such as Tycoon2FA, FlowerStorm, and EvilProxy were identified as key enablers of business email compromise attacks. These platforms offer sophisticated, continuously updated toolkits capable of bypassing modern defenses, including multifactor authentication. eSentire researchers noted that attackers could initiate BEC actions, such as creating inbox forwarding rules, within as little as 14 minutes after obtaining valid credentials and session tokens.
While business email compromise represented less than 10% of all malicious activity in 2025, reflecting a 21-percentage-point decline from the previous year, it remained one of the most financially damaging threats facing organizations. Industries most affected by BEC included real estate, finance, retail, and construction, where transactional workflows and payment processes are particularly vulnerable to manipulation.
Additional findings revealed a fourteenfold increase in attacks combining email bombing with IT help desk impersonation, particularly targeting legal firms. The ClickFix social engineering lure surged by 300%, accounting for over 30% of all malware delivery cases. Sector-wise, the software industry experienced the highest number of security incidents, followed by manufacturing and business services, while construction, hospitality, and legal sectors saw a notable decline in overall cyber incidents during 2025.
What Undercode Say:
Credential Theft as the New Default Strategy
Credential theft is no longer a specialized technique reserved for advanced actors. It has become the default entry point for cybercrime operations of all sizes. The economics are simple: stealing access is cheaper, faster, and more scalable than exploiting vulnerabilities, especially in cloud-first environments where identity grants immediate reach.
Phishing-as-a-Service Industrializes Crime
The rise of PhaaS mirrors the evolution of ransomware-as-a-service from previous years. These platforms lower the barrier to entry, allowing less-skilled actors to deploy highly effective campaigns using professionally maintained infrastructure. Continuous updates and customer-style support make these kits resilient against defensive improvements.
MFA Bypass Changes the Risk Equation
The ability of modern PhaaS kits to bypass multifactor authentication fundamentally alters enterprise security assumptions. MFA alone is no longer a sufficient control when attackers can intercept session tokens or proxy authentication flows in real time, turning trusted defenses into false assurances.
Cloud Platforms as High-Value Targets
Microsoft 365’s prominence in these attacks reflects its central role in business communication and identity management. Once compromised, a single cloud account can provide access to email, documents, internal chats, and third-party integrations, amplifying attacker impact without deploying a single piece of malware.
Speed Is Now a Weapon
The report’s finding that attackers can operationalize stolen credentials within minutes highlights a critical defensive gap. Traditional detection models, which assume longer dwell times, are increasingly ineffective against adversaries who act immediately after access is obtained.
Business Email Compromise Still Pays
Despite a relative decline in volume, BEC remains one of the most profitable cybercrime tactics. Its persistence suggests that even modest success rates yield substantial financial returns, especially in industries where trust-based transactions are routine.
Social Engineering Outpaces Exploitation
The surge in ClickFix and help desk impersonation attacks shows that human workflows are now more frequently exploited than software flaws. Attackers are optimizing for psychological leverage, not technical complexity.
Sector Shifts Reveal Defensive Maturity
Industries showing reduced incident rates may reflect improved awareness and controls, while spikes in software and manufacturing suggest expanding attack surfaces tied to digital transformation and supply chain dependencies.
Identity-Centric Security Is No Longer Optional
The data reinforces that identity, not endpoints, is the primary battleground. Organizations that continue to treat credential security as a subset of IT hygiene risk falling behind attackers who have fully embraced identity-first intrusion models.
Attack Toolchains Are Converging
Credential theft, phishing, BEC, and malware delivery are no longer separate tactics but interconnected stages of a single operational pipeline. Defending against one in isolation leaves gaps that attackers readily exploit.
Detection Must Move Upstream
Stopping these attacks requires earlier intervention, at the point of credential harvesting or anomalous authentication behavior. Post-compromise response is increasingly too late to prevent damage.
The Trust Layer Is Under Siege
Ultimately, these trends reflect a broader erosion of digital trust. When attackers can convincingly impersonate employees, vendors, and executives, technical defenses alone cannot restore confidence without systemic changes to authentication and verification practices.
Fact Checker Results
✅ eSentire data confirms a 389% year-over-year rise in account compromise incidents.
✅ Phishing-as-a-service platforms were responsible for the majority of credential theft cases observed.
❌ The decline in malware does not indicate reduced attacker capability, only a shift in preferred tactics.
Prediction
🔮 Credential theft will overtake ransomware as the most profitable cybercrime model in the next two years.
🔮 MFA bypass techniques will drive rapid adoption of phishing-resistant authentication standards.
🔮 Identity-focused security platforms will become the primary investment priority for enterprises.
🕵️📝✔️Let’s dive deep and fact‑check.
References:
Reported By: www.infosecurity-magazine.com
Extra Source Hub (Possible Sources for article):
https://www.reddit.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
Bing
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon
