🧠 Food for thought

Implications, context, and why it matters.

Stolen identities now drive more cybercrime than software bugs

• Identity-based attacks have moved ahead of software exploit-led cloud incidents 1.
• In 2025, most confirmed cloud incidents came from stolen, exposed, or misused login credentials. Hospitals, physician clinics, and retail businesses ranked among the top targets 1.
• The dark web market is well established. “Stealer logs,” datasets built by malware that steals usernames, passwords, cookies, and device data, made up 67.12% of advertised and shared datasets. That was higher than “combolists,” or bundled username-password lists, at 16.47%, while leaked credentials reached 5.96% 1.
• AI-enabled cybercrime tools such as WormGPT and FraudGPT, malicious chatbot-style tools sold for phishing, fraud, and other abuse, are marketed as services and products. BruteForceAI is part of the same market, and these “crime service kits” track with a rise in ransomware victims 1.

Cybercrime now runs like an industry, pushing defenders to move faster

• Cybercrime now works as a connected system. Groups cover the full life cycle. They include access brokers who sell entry into hacked systems. They also include botnet operators who run networks of infected devices 2.
• Speed now shapes risk. Newly disclosed vulnerabilities can be exploited within hours or days rather than weeks 3.
• Fortinet says security teams need a defense model built for automation. It also says teams need AI-enabled tools that can respond at the pace of current threats 2.
• Public-private work is part of the response. The World Economic Forum’s Cybercrime Atlas maps cybercriminal networks. A joint effort led by INTERPOL, the international police organization, and supported by Fortinet helped take down a cybercriminal network in Operation Red Card 2.0 2.