According to a new report from Nordlayer, a credential from an employee of a Fortune 500 company is posted on the dark web every 100 seconds. The report states that almost 10 million credentials, which include both usernames and passwords of Fortune 500 employees, have been leaked on the dark web and are presently available to threat actors. And threat actors use them: boy, do they ever! This is the easiest way for threat actors to infiltrate a company network and launch different types of attacks, including the most dreaded: a ransomware attack.
The report notes that 99% of the credentials were stolen from web browsers. Many employees insert and save their usernames and passwords into their work computer browsers, whether the site visited is for personal or business purposes. Threat actors target employees to download malware called an infostealer, and when a victim downloads an infostealer without knowing, the malware is able to copy all of the logins saved in the browser. Bingo! Now they have the credentials to access the company network and have full access to the files and data that the employee has permission rights to access.
Another way threat actors obtain credentials is when a company doesn’t offboard an employee and the credential remains active. If the credential has not been decommissioned and is compromised and available on the dark web, a threat actor has full access to the company network as if the offboarded employee was still working.
What’s the fix? Nordlayer says:
With 6.6 million corporate email addresses in circulation, large organizations should assess how many of their employees’ credentials are already on the dark web and what those logins can still reach.
This is not exclusively a large organization risk. The report shows that “the highest individual rates [of compromised credentials] come from midsize technology companies.” The risk is much higher for companies where most employees hold a corporate email account and save logins in a browser. On the other hand, companies where much of the workforce doesn’t receive a corporate email address, the risk is obviously lower as they do not have credentials to expose.
Credential harvesting and stealing continues to be the easiest way for threat actors to access company networks. The dark web is obviously full of them. Employees need to be counseled on the risks presented, that they should never provide their credentials to anyone who asks, how to change their passwords and phrases frequently, and to be cautious about saving passwords in web browsers. In addition, companies need to be aware of this growing problem, monitor the dark web for company credential leaks, and have a tight process for decommissioning credentials.