In June 2025, datasets containing around 16 billion login credentials were compromised across platforms like Apple, Google and Facebook. Fast forward to 2026 and the IBM X-Force Threat Intelligence Index reveals the number of AI chatbot credentials for sale on the dark web – 300 000.
Stolen credentials from South Africans are being sold for miniscule amounts – as little as R100 – on the dark web, while dark web sales of executive and corporate credentials are sold at a premium. These credentials are contributing to the impressively rapid growth of data-theft attacks and dark web subscription services that sell the information successfully gleaned from these attacks.
Sensitive system information, high-risk user credentials, social media account data, credit card information and hacked logins are dark web commodities. And those most at risk are the technical leads, finance directors and C-suite executives whose compromised access give threat actors the most leverage.
As organisations consolidate authentication around centralised identity platforms like Microsoft Entra ID, Okta and AWS IAM Identity Center, a single compromised credential runs the risk of unlocking dozens of connected systems simultaneously. The centralisation that makes enterprise access more convenient is making credential theft exponentially more valuable.
What makes the situation even more complex is that high-risk users are also the most attractive social engineering targets. They’re drawn into developer communities, professional forums or collaborative groups that aren’t entirely legitimate, enticed into these environments by bad actors impersonating colleagues so they can steal their credentials. In many cases, the theft takes place before the target even realises they are one.
Once the criminals have established access to systems, they rarely make an immediately obvious move. Using legitimate systems like PowerShell, WMI and Remote Desktop Protocol, they can remain undetected for days. They’re not running malware or infiltrating through a virus; they’re running your own tools under your own credentials at a pace slow enough not to trigger anomaly detection.
It is entirely possible for threat actors to live within your environment for up to four years, harvesting information and then, only then, executing a massive attack. By the time this lands, the groundwork is so thoroughly embedded that breach investigations are more like archaeology.
The answer to this isn’t necessarily perimeter defence, although this will always be an essential part of any organisation’s defence, but rather to invest in earlier intelligence.
Imagine having access to the dark web itself and having the ability to detect exposure before the attack chain is complete. Security solutions now offer companies the ability to scan for credentials circulating in underground markets, sensitive data in criminal forums, high-risk users present in threat actor communities, and the kind of credential reuse that signals a serious and exploitable gap.
These scans run continuously and provide you with insight into what credentials belonging to which high-risk individuals are up for sale, or at risk of exploitation. And this allows you to protect and prevent before the incident takes place and effectively nullify the credentials before they can be used.
It’s a more collaborative and intuitive approach to security that takes protection beyond the endpoint and into the user domain. When credentials are found, it allows you to have conversations with high-risk users that aren’t about failure but rather about how to more effectively close the gap. It frames the challenge in a way that makes it easier for high-profile users to embrace more rigorous credential management and security awareness.
The benefit of this level of deep detection is multi-layered. First, early detection can potentially save the business upwards of $1.8 million per breach, according to IBM. Second, it allows you to catch stolen credential risk early before it has a significant impact on the business. And finally, it provides an opportunity to refine credential management and quality, so your high-risk users are at the forefront of identity and access management and protection.
South African companies are currently facing around 1 800 attacks a month and many of the credentials enabling those attacks are already available. Protection comes down to answering a single question – who is going to find them first? Your security company or the threat actor?
Share
Editorial contacts