Threat Data Guide

When a third-party service is breached, attacker access to databases exposes all records stored by that service.

Depending on how the service stored credentials, SpyCloud may recover plaintext passwords, weakly hashed passwords (which can be cracked), or salted hashes.

The most valuable breach records contain reusable passwords – and most do.

The password reuse problem is the core risk here.

Most people reuse passwords across personal and professional accounts.

An employee's password exposed in a breach of a consumer platform – a streaming service, a shopping site, a social network – is often the same password (or a minor variation) they use to log into your corporate systems.

Attackers know this and automate credential stuffing attempts against enterprise targets within hours of acquiring breach data.

Even when users change passwords, they often follow predictable patterns:

• Appending a number
• Capitalizing the first letter
• Substituting characters (pa$$word)

SpyCloud's analytics surface these patterns. A password that's "different" may not be different enough to stop an attacker using rule-based cracking.

Modern web applications authenticate via session tokens, not passwords.

When malware steals an active session cookie, an attacker can replay that cookie against the target application and gain authenticated access – without knowing the password and without triggering any MFA prompt.

This technique, known as pass-the-cookie or session hijacking, is now standard in attacker toolkits. Unlike AiTM phishing, which intercepts credentials in transit, pass-the-cookie operates entirely post-authentication – making it invisible to login-layer controls.

The infected device may:

• Still be infected and actively exfiltrating data
• Still have active C2 communication
• Still have access to corporate systems
• Expose additional applications not visible in the alert

Unmanaged and BYOD devices present a compounded risk: they fall outside your standard EDR coverage, may never be fully remediated, and can serve as persistent footholds even after credentials are reset.

It is recommended to escalate unmanaged device alerts for separate triage – do not treat them the same as managed endpoints.

Adversary-in-the-middle (AiTM) phishing kits proxy the real login page in real time, capturing both the password and the MFA token as the victim enters them.

The attacker immediately replays those credentials against the real service before the session expires – bypassing MFA without the victim ever knowing.

SpyCloud's phishing intelligence captures two distinct signals:

Pre-phish: Targeting data from phishing infrastructure – SpyCloud identifies that your employee or customer is being targeted before the phish lands. This is prevention intelligence.

Post-phish: Credentials already captured by a phishing kit – the phish has succeeded and credentials are in attacker hands. This is incident response intelligence.

Executive accounts provide attackers with elevated access, financial authorization capabilities, and high-trust positions for social engineering downstream targets.

Spear-phishing campaigns targeting executives (business email compromise, vendor fraud) are among the highest-ROI attack types for criminal operators.

Modern stuffing operations run millions of credential attempts across multiple targets simultaneously.

Attackers use residential proxies, distributed infrastructure, and low-and-slow authentication patterns to evade detection.

A URL:Login:Password entry is not just a credential – it's a ready-made attack instruction. The attacker knows exactly which login endpoint to target, which credential format to submit, and which service they're attacking.

ULP-formatted combolists reduce attack setup time to near zero and enable highly targeted stuffing campaigns against specific applications.

Unlike a breach with a known source, combo lists aggregate credentials from multiple origins. Your affected users may not appear in any single identifiable breach – making it harder to scope the exposure or trace the credential source.

SpyCloud surfaces combolist matches regardless of origin, giving you actionable exposure data even when the root breach is unknown.