Infostealer malware exposed at least one employee or customer login at 72% of the 4,824 companies analysed across the US and Europe over the past year, according to research published by Swedish cybersecurity company Outpost24.
The study identified 31.5 million exposed credentials in total, although fewer than 3% were stolen directly from infected devices using infostealer malware.
The Credential Exposure Benchmark Report covers credentials first identified in the 12 months to 1 September 2026. Also, it examines five sectors: financial services, consumer goods and services, government, business services, and healthcare.
Most of the exposed credentials were not newly stolen. Around 30.7 million, or 97% of the total, came from breach dumps and combolists, collections of previously leaked usernames and passwords circulated among cybercriminals.
The remaining 844,000 credentials, fewer than 3% of the total, were extracted directly from infected devices using infostealer malware.
These attacks can expose more than passwords. They also collect session cookies, which allow users to remain logged into services, making them a stronger indication of recent compromise.
Despite representing a small share of all exposed credentials, infostealer infections affected a large proportion of the companies studied.
At 41% of firms, at least one stolen credential was linked to a work email address, suggesting that an employee’s device had been infected. Another 31% had malware-related credentials linked exclusively to customer accounts.
“An infostealer doesn’t stop at one password. It can take session cookies, saved credentials, and access to multiple accounts,” said Borja Rodriguez, Outpost24’s head of threat intelligence.
The differences between industries were more pronounced than those between countries.
Business services companies faced greater exposure among employees: 47% had at least one work login stolen by malware.
Financial services firms had the highest proportion of companies with infostealer-related credentials overall, at 77%.
European companies recorded an average of 224 exposed logins, 22% more than the 184 found at a typical US firm. Within Europe, Nordic companies had the highest average, at 358 per firm, while Spain had the lowest, at 133.
Consumer businesses in the Benelux region were the most exposed sector-country group, averaging 1,285 leaked credentials.
“Thousands of stolen customer logins tell a very different story from a handful of compromised employee accounts,” Rodriguez said.
Outpost24 advises security teams to treat an infostealer detection as a possible sign of a wider compromise, rather than simply resetting the affected password.
For employees, that means examining the infected device for other stolen information and terminating active sessions. Customer accounts require password resets, additional authentication checks, and monitoring for fraudulent activity.
The distinction matters because the number of exposed credentials does not necessarily reflect the severity of a security incident.
A retailer with thousands of compromised customer accounts may appear more exposed than a bank with a single infected employee laptop. But that one device could give attackers access to an active session inside the company’s systems.
Several recent incidents illustrate the risk, like the 2024 attacks against Snowflake customers that relied on credentials stolen through infostealer malware.
In October, attackers accessed Meta’s GitHub repositories using a stolen employee login. Binance has also traced its $6.3bn theft to malware installed on engineers’ computers.