SpyCloud’s 2026 Identity Exposure Report Reveals Explosion of Non-Human Identity Theft

0:00This audio is presented by Hacker Noon, where anyone can learn anything about any technology. Spike Cloud's 2026 Identity Exposure Report reveals explosion of non-human identity theft by Cyber Newswire. Austin, Texas, USA, March 19, 2026, Cyber Newswire, new report highlights surge in exposed API keys, session tokens, and machine identities, and more. Spike Cloud, the leader in identity threat protection, today released its annual 2026 Identity Exposure Report, one of the most comprehensive analyses of stolen credentials and identity exposure data circulating in the criminal underground and highlighting a sharp expansion in non-human identity NHI, exposure. Last year, Spike Cloud saw a 23% increase in its recaptured identity data lake, which now totals 65. 7B distinct identity records. The report shows attackers are increasingly targeting machine identities and authenticated session artifacts in addition to traditional username and password combinations and personally identifiable information, P.

1:04Greater than, we're witnessing a structural shift in how identity is exploited, said greater than Trevor Heligas, chief intelligence officer at Spike Cloud. Greater than, attackers are no longer just targeting credentials. They're stealing greater than authenticated access, including API keys, session tokens and automation greater than credentials, and using this access to move faster, stay persistent, and scale greater than attacks across Cloud and enterprise environments. Key findings from the 2026 Identity Exposure Report, non-human identities are now a core attack surface Spike Cloud recaptured 18. One million exposed API keys and tokens in 2025, spanning payment platforms, Cloud Infrastructure Providers, Developer Ecosystems, Collaboration Tools, and AI Services. The report also identified six. Two million credentials are authentication cookies tied to AI tools, reflecting rapid enterprise adoption of AI platforms and the associated expansion of machine-based access paths. Unlike human credentials, these NHIs often lack MFA enforcement,

2:09rotate infrequently, and operate with broad permissions. When exposed, they can provide attackers with persistent access to production systems, software supply chains, and Cloud Infrastructure. Fishing is an enterprise threat Spike Cloud recaptured 28. Six million fished identity records in 2025. Notably, nearly half of those identities were corporate users, reinforcing that fishing remains a persistent enterprise threat. This trend aligns with Spike Cloud research showing that successful fishing attacks have surged 400% UI. The result is a clear warning to enterprises. Their workforce is now 3x more likely to be targeted with fishing attacks than info-stealer malware. Modern fishing data sets increasingly contain more than credentials. Many include session cookies, authentication tokens, and MFA workflow data, allowing attackers to assume authenticated sessions without triggering traditional alerts. With an influx of bad actors leveraging AI to craft more realistic lures and automate campaigns, this problem is not going away anytime soon, and enterprise security teams must go beyond

3:14employee training for a more true preventative approach. Session theft and MFA bypass continue a T-scale Spike Cloud recaptured 8. Six billion stolen cookies and session artifacts exposed through malware infections, demonstrating continued attacker focus on session hijacking techniques that bypass traditional authentication safeguards. In parallel, Spike Cloud analysis of underground comb lists found that 51% of records overlapped with previously observed infestular logs, indicating that criminals are increasingly repackaging malware exfiltrated data rather than relying solely on fresh breach disclosures. Public reporting throughout the past year has documented multiple MFA bypass campaigns leveraging adversary in the middle, ADEM, fishing kits and session replay techniques, including activity targeting Microsoft 365 environments through stolen authentication tokens. On March 4, 2026, Europle announced, in partnership with Microsoft and other private organizations, that it had executed a coordinated seizure of Tycoon 2FAA major fishing as a

4:18service infrastructure and service that enabled widespread MFA bypass through ADEM techniques and disrupted its operation alcapability significantly. Spike Cloud supported the global disruption effort by contributing victim identity intelligence and operational analysis drawn from criminal underground sources. The recent operation highlights the industrialization of fishing in the growing value of session artifacts in attacker workflows. Malware continues to exfiltrate identity data despite the rise of fishing, infestular malware remains a significant contributor to identity exposure, enabling attackers to harvest credentials, cookies, and authentication tokens from infected devices. Spike Cloud recaptured over 642, 4 million exposed credentials from 13, 2 million info stealer malware infections in 2025. That's an average of 50 exposed user credentials per malware infection, further expanding the amount of entry points available to bad actors. A notable portion of infections occurred on endpoints with EDR or antivirus tools installed, reinforcing

5:21that endpoint controls alone are not sufficient top-revent identity theft. Credential exposure remains high, with weak password HYGIE and ESPYCLOD recaptured 5. 3 billion credential pairs, stolen credentials CONSISTINGOF usernames OR email addresses and passwords. Among exposed corporate credentials, 80% contained plaintext passwords, significantly lowering the barrier to immediate account takeover attacks. Once again, predictable patterns tied to pop culture, sports, and short numeric strings continue to be used broadly. Top-trendy passwords include 67, 67, 140, 4M, sweet, cookie, candy, cake, pie, 5, 7M, chiefs, Kansas City chiefs, 5M, 2025 to 4, 1M, Apple, banana, orange, strawberry, fruit, 2, 6M, password reuse remains widespread, and the report

6:23also identified one. 1 million password manager master passwords circulating in underground sources, raising concerns about vault-level compromise when master credentials are weak. The expanding identity exposure surface the 2026 report highlights a central shift in identity threats and underscores the need for continuous identity threat protection across both human and machine identities. Attackers are combining breach data, fishing captures, malware logs, session tokens, and machine credentials to construct composite identity profiles that fuel everything from session hijacking and ransomware to supply chain compromise. As organizations accelerate cloud adoption and embed AI tools across workflows, machine identities are becoming deeply integrated into critical systems. The theft of these credentials and authentication tokens can create downstream ripple effects far beyond a single compromised account. The challenge isn't just stopping fishing or malware, Heligos added, it's understanding how exposed identities connect across systems, vendors, and automation workflows. He continues, spy cloud has recaptured

7:27nearly one trillion stolen identity assets in our 10 years of disrupting cybercrime. It's the basis of our insights and the evolution of identity sprawl and the ways in which bad actors aim to weaponize data against individuals and businesses. But there is good news for defenders, when organizations continuously monitor exposure and build and automated remediation workflows, we've seen how that can significantly shrink the attacker's window of opportunity, and that's a win-worth fighting for. Full report and in-depth analysis available here, about SPY clouds by cloud transforms recaptured darknet data to disrupt cybercrime. Its automated identity threat protection solutions leverage advanced analytics and AI to proactively prevent ransomware and account takeover, detect insider threats, safeguard employee and consumer identities, and accelerate cybercrime investigations. SPY clouds data from breaches, malware-infected devices, and successful fish-as-also powers many popular dark web monitoring and identity theft protection offerings. Customers include seven of the Fortune 10, along with hundreds of global

8:31enterprises, mid-sized companies, and government agencies worldwide. Headquartered in Austin, Texas, SPY cloud is home to more than 200 cyber security experts whose mission is to protect businesses and consumers from the stolen identity data criminals are using to target them now. To learn more and see insights on your company's exposed data, users can visit SPY cloud. Come, contact Katie Hannah-Shick R.E.Q on behalf of SPY cloud SPY cloud at Rec. CEO This Story was published as a press release by Cyber Newswire under Hackernoon Business blogging program disclaimer. This article is for informational purposes only and does not constitute investment advice. Cryptocurrencies are speculative, complex, and involve high risks. This can mean high prices volatility and potential loss of your initial investment. You should consider your financial situation, investment purposes, and consult with a financial advisor before making any investment decisions. The Hackernoon editorial team has only verified the story for grammatical accuracy and does not endorse or guarantee the accuracy, reliability, or completeness of the

9:36information stated in this article. Hashtag dyor thank you for listening to this Hackernoon Story, read by artificial intelligence. Visit Hackernoon.com to read, write, learn, and publish.