Credential Theft Becomes Cybercriminals’ Favorite Target

NEWS BRIEF

After analyzing more than a million pieces of malware collected in 2024, researchers have found that 25% of them target user credentials.

That’s three times the number from 2023 and has bumped stealing credentials from password stores into the top 10 techniques listed in the MITRE ATT&CK framework, which accounted for 93% of all malicious cyber activity in 2024.

In “The Red Report 2025” conducted by Picus Security, researchers observed that the attackers are prioritizing “complex, prolonged, multi-stage attacks that require a new generation of malware to succeed.” In what the researchers dubbed “SneakThief,” threat actors are looking to revolutionize info-stealing malware, focusing on increased stealth, persistence, and automation.

The researchers add that threat actors likely have their sights set on these malware attributes in order to pull off “the perfect heist,” adding that most malware samples now have the capability to do so with more than a dozen malicious actions installed to help bad actors evade defenses, exfiltrate data, and more.

The researchers also report they found no evidence that cybercriminals are using AI-driven malware, and that malware samples on average can complete 14 malicious actions. And of the millions of cybercrime acts seen in 2024, exfiltration and stealth tactics made up 11.3 million.

“Focusing on Top 10 MITRE ATT&CK techniques is the most viable way to stop the kill chain of sophisticated malware strains as early as possible,” said Volkan Ertürk, CTO and co-founder of Picus. “SneakThief malware is not an exception; enterprise security teams can stop 90% of malware by focusing on just 10 of MITRE’s entire library of techniques.”