The credential theft and access broker ecosystem has continued to be the foundational layer of much of the criminal cyber activity through 2025 and into 2026. The mid-May 2026 picture is worth a working read because the underlying dynamics shape the defensive priorities for the rest of the year.

The supply side of the ecosystem.

Infostealer malware operations have continued to be the primary mechanism of credential generation. The major infostealer families have remained operationally active. The pattern of distribution through malicious advertising, software piracy, gaming-related lures, and similar pathways has been broadly consistent with prior years.

The volume of stolen credentials available on the criminal marketplace at any given moment is enormous. The major credential marketplaces and access broker channels carry tens of millions of fresh credential records on a continuous basis. The pricing has been stable.

The infostealer operations have continued to evolve technically. The detection evasion has improved. The credential and session token harvesting capability has been refined. The data exfiltration patterns have continued to use legitimate cloud storage services and consumer messaging platforms in ways that make pure network-based detection harder than it used to be.

The credential aggregator and dump consolidation services have continued to operate. The combination of fresh stolen credentials and historical credentials from breaches creates a continuously refreshed credential corpus that the criminal ecosystem has free access to.

The intermediation layer.

The access broker market sits between the credential-theft supply and the ransomware/operational-criminal demand. The access brokers acquire credentials, validate them, sometimes escalate the access, and sell the resulting access to other criminal operators.

The maturation of this intermediation layer has been one of the more important structural developments in the criminal cyber economy over the last several years. The access broker provides the labour-intensive work of credential validation, initial access establishment, and lateral movement to a usable foothold. The downstream criminal operator pays for clean validated access rather than buying raw credentials and doing the work themselves.

The pricing in the access broker market gives useful intelligence on the threat landscape. The price for access to a credentialed account at a large enterprise typically runs into low five figures depending on the apparent value of the access. The price for general consumer account credentials is much lower. The variation in pricing across sectors and access types provides reasonable signal on what criminal operators value.

The demand side.

The ransomware operators are the largest single category of demand for stolen credentials and access broker services. The pattern is generally that a ransomware operator buys access to an enterprise environment from an access broker, escalates the access, conducts the data theft and the deployment, and runs the extortion.

The business email compromise and the wire transfer fraud operators are another major demand category. The stolen credentials for cloud productivity environments — Microsoft 365 in particular — are the foundational input for the financial fraud operations.

The state-aligned and APT operators are demand actors at the higher end of the market. The stolen credentials for specific targets of interest are a particular category of access that the broader criminal ecosystem services in some form.

The information theft operators — the ones selling stolen corporate data, intellectual property, or sensitive personal information — are another demand category. The stolen credentials enable the data access that supports this market.

The defensive implications.

The defensive priority that follows from this ecosystem picture is straightforward in concept but difficult in execution. The credential is no longer a viable single factor of authentication for any access that matters. The continuous assumption that credentials are compromised, the layered defence that does not rely on the credential remaining secret, and the rapid detection of credential abuse are the foundational defensive postures.

The specific defensive practices that follow:

Multi-factor authentication universally and phishing-resistant where possible. The number of organisations that still allow single-factor authentication for sensitive access in 2026 is concerning. The transition to phishing-resistant MFA — passkeys, hardware tokens, certificate-based authentication — has continued but is far from complete across the broader market.

Conditional access based on identity context. The ability to evaluate the broader context of an authentication attempt — device posture, location, behavioural patterns — and to require additional assurance for risky contexts is a major defensive lever. The identity infrastructure investment continues to be one of the highest-impact defensive investments.

Session token protection. The shift in attacker focus from password theft to session token theft has been a continued trend through 2024–2026. The defensive response includes session token binding to device, more aggressive session refresh requirements for sensitive access, and detection of session token misuse.

Detection of credential abuse. The volume of credential-based authentication activity in any large environment is enormous and the detection of malicious use within the haystack of legitimate use requires sophisticated tooling and skilled operations. The investment in this capability continues to be one of the most consequential.

Privileged access reduction. The minimisation of standing privileged access — through just-in-time access, time-bounded privilege elevation, and the reduction of always-on administrative accounts — limits the damage of any single credential compromise.

User awareness and friction. The continued investment in user awareness of phishing and credential theft remains useful. The friction added to suspicious access requests — the “are you sure this is you” prompts at the right moments — meaningfully reduces successful credential abuse.

The outlook for the rest of 2026.

The credential theft and access broker ecosystem will continue to operate at scale through the rest of the year. The defensive investment by enterprises will continue to make progress against the threat but will not close the gap entirely. The major incidents will continue to have credential abuse as a foundational element.

The realistic defensive posture is that credential compromise is a constant background condition. The work is to build the layered defence that makes credential compromise less directly consequential rather than to prevent credential compromise from happening at all. The organisations that have internalised this posture are operating in a more defensible position than the organisations that are still hoping the credential remains a meaningful secret.