Categories: Dark Web

24.6 Billion Pairs of Credentials For Sale on The Dark Web

As of this year, there are over 24.6 billion credential pairs are available or actively getting circulated on the dark marketplaces or dark web. However, it indicates that cybercrime has become a profitable business, one that has become extremely widespread.

At this point, it seems that one of the most hyped internet security categories is passwordless technology. Despite those initiatives, the reality is that passwords still remain firmly entrenched in the minds of many users.

As compared to the figures for the year 2020, the figures for last year showed an increase of 64%. In comparison to the two years prior to 2020, this represents a significant slowdown.

Limitless compromised data

The number of credentials for sale flew up by over 300 percent in the year between 2018 and the year the pandemic started. 

It is estimated that 6.7 billion of the 24.6 billion credentials are unique, which represents that over the past two years there is an increase of 1.7 billion. The figure equates to a 34 percent increase over where we were in 2020.

Cybersecurity analysts at Digital Shadows have claimed that almost 75% of the passwords, that’s the majority of passwords, available online for sale are purely common and easy to guess; in short, there is no uniqueness.

It is very easy for a cybercriminal to choose a compromised credential and attempt to use it since they have a limitless list of hacked credentials.

Here the primary culprit is the “Weak Password,” in short, an attacker can easily guess the passwords with the help of automated tools and compromise multiple accounts at a time.

The 123456 password appears in almost every 200 passwords offered by criminals, which is why many of those credentials have been stolen and compromised.

Weak Spots Enabling The ATO Attacker

Here below we have mentioned all the weak spots that are enabling the Account Takeover (ATO) attacker:-

  • Ever-Expanding Digital Footprint
  • Authentication Blind Spot
  • Too Late Attempts At Account Protection

Lifecycle of an ATO Attack

Taking part in an ATO is much like engaging in any kind of cyberattack: It begins with a mistake or a misconfiguration that enables the threat actors to take full advantage of the situation.

It continues to be difficult to detect until it is too late, but it is eventually caught. In a typical lifecycle, ATO can thrive in many scenarios, but the four main stages are parts of a typical lifecycle. And here below we have listed them all:-

  • Identification
  • Acquisition
  • Verification
  • Exploitation

Among the companies that have already agreed to implement FIDO-based authentication are Apple, Google, as well as Microsoft.

The problem of stolen and manipulated credentials used for ATO remains a growing problem, and organizations cannot afford to ignore it.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates.

Balaji

BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Recent Posts

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS devices.…

2 days ago

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch Experts…

3 days ago

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan exploits…

4 days ago

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on organizations…

4 days ago

Google Chrome Security, Critical Vulnerabilities Patched

Google has updated its Chrome browser, addressing critical vulnerabilities that posed potential risks to millions…

4 days ago

Notorious WrnRAT Delivered Mimic As Gambling Games

WrnRAT is a new malware attack that cybercriminals have deployed by using popular gambling games…

4 days ago