When an employee’s password turns up in an infostealer malware log, it’s often an unknown, unassessed, uncategorized risk. Changing it only addresses part of the incident. Any device the employee used for work may have exposed other saved logins and the session cookies that keep accounts signed in. For the company, immediate concerns are: which device was infected, which services the employee accessed from it, and which sessions need to be revoked. (outpost24.com)

Outpost24 released its 2026 Credential Exposure Benchmark Report on Tuesday. Across 4,824 organizations with exposed credentials, 72% had staff or customer credentials identified in infostealer malware logs. Borja Rodriguez, Head of Threat Intelligence at Outpost24, pointed out the key takeaway: “Less than 3% of exposed credentials came directly from infostealer logs, yet nearly three-quarters of organizations were affected. That tells us why counting stolen passwords isn’t enough. An infostealer doesn’t stop at one password. It can take session cookies, saved credentials and access to multiple accounts. Resetting a password may close one door while leaving others wide open.”

Before IT closes the ticket, someone needs to establish which device the password came from and what else an attacker could access. Among 4,824 organizations in the United States and Europe already known to have exposed credentials, 41% had at least one staff email address associated with a login stolen by infostealer malware. When researchers included customer logins, the share rose to 72%. (outpost24.com, vmblog.com)

This is a critical distinction because it involves an immediacy, but also subsequent potential events, and companies who now need to decide how to handle cases of expanding credential alerts. Most of the 31.5 million credentials researchers examined appeared in breach dumps and compiled lists, where an old password can resurface. Fewer than 3% came directly from infostealer logs. For an IT team, the logs are a specific starting point from which to investigate. The device that yielded a work login could be a company laptop or a personal computer an employee used to sign in. (outpost24.com, vmblog.com)

“Resetting a password may close one door while leaving others wide open,” added Rodriguez. “Security teams need to investigate the infection, not just the exposed credential.”