Identity Threats Hit Retail Where Security, Fraud, and Operations Meet
See what SpyCloud’s 2026 research reveals about government identity threats, including visibility gaps, NHIs, third-party exposure, and remediation maturity.
See what SpyCloud’s 2026 research reveals about government identity threats, including visibility gaps, NHIs, third-party exposure, and remediation maturity.
AitM phishing kits relay a real login, let the victim finish MFA, and keep the session token. See how the theft works and how to respond.
Learn the key capabilities, vendor questions, and common mistakes to avoid when choosing an identity threat protection platform for your organization.
SpyCloud’s 2026 Identity Threat benchmark research shows non-human identities were the most common initial access vector for software and technology organizations, at 28%. AI access is outpacing governance: 84% give AI tools or agents access to internal systems or data, but only 18% have visibility into AI-related NHI exposures.
SpyCloud researchers analyzed over 66,000 U.S. water and wastewater systems and their vendors – finding that identity exposure, from stolen credentials to hijacked sessions, runs on a track of its own, separate from the OT risks making headlines.
Session hijacking, AiTM phishing, SIM swaps, and more: a sourced breakdown of six identity attacks, with a comparison table and defenses for each.
SpyCloud Labs researchers reverse engineered Remus, a Windows infostealer sold on underground marketplaces since March 2026. Remus steals browser cookies, AI credential folders, crypto wallets, and 2FA extensions, strips syscall hooks to blind EDR, and pulls its C2 from Ethereum smart contracts. Its obfuscation and Chromium theft routines mirror LummaC2.
Chinese PII, FortiBleed, Klue, and more – SpyCloud tracks 2026’s confirmed data breaches as they happen, and helps you check your own exposure.
Phishing-as-a-service kits like Tycoon 2FA and Kali365 now steal live sessions and OAuth tokens instead of passwords, letting attackers bypass MFA entirely – here’s a breakdown of 2026’s most active kits and how to stop them.
SpyCloud Labs data shows StealC fell 90% before the June 24 Operation Endgame takedown. See what our post-takedown analysis reveals.
SpyCloud Labs analyzed the media-dubbed “FortiBleed” leak and found that initial reports left some key information out. See what we found after parsing and analyzing the data to understand the full impact.
SpyCloud researchers dissect Kali365, a Telegram-sold phishing-as-a-service kit targeting Microsoft 365. Using device-code and adversary-in-the-middle phishing, it steals OAuth tokens and session cookies to bypass MFA – then staged a fake FBI “shutdown” while operations continued. Here’s how the kit works, who it targets, and why password resets won’t stop it.
The 2026 Verizon DBIR is the largest breach dataset ever analyzed – and the findings hit close to home for identity security teams. SpyCloud unpacks the numbers that matter most: why stolen credentials still drive nearly 4 in 10 breaches, how infostealers are fueling ransomware, and why MFA alone can’t protect the sessions attackers are already stealing.
Uncover the latest identity security threats in the 2026 Identity Exposure Report. Learn how cybercriminals are exploiting stolen data and what you can do to stop them.
See how malware infection logs can help organizations spot fake North Korean IT workers engaging in employment fraud.
Get insights from SpyCloud’s latest insider threat report. Learn what 100 CISOs say about their biggest insider risk challenges in 2025.
IBM’s 2025 Cost of a Data Breach Report is here and identity threats take center stage. See what’s shaping breach costs, attack trends, and security priorities for the year ahead.
Explore key takeaways from the 2025 Verizon DBIR. See how identity threats, ransomware, and third-party risks impact your defenses.
Cybercriminals target government agencies to steal credentials and sensitive data. Learn five essential identity protection strategies to defend against cyber threats.
Discover the biggest wins from 2024 against cybercrime—from major infostealer takedowns to global ransomware crackdowns—and what they mean for the future of cybersecurity.
The cost of a data breach rose again this year. Get the key findings from IBM’s Cost of a Data Breach Report 2024.
SpyCloud breaks down key points from the Verizon 2024 Data Breach Investigations Report. ✓ Read our recap of the highlights.
Here’s what we found when we analyzed The Post Millennial data breach, including the types of exposed data assets contained in the 87 million leaked records.
Our 2024 Identity Exposure Report showcases just how big the stolen data problem is today. Here’s what we learned in our annual analysis of recaptured breach & malware data from the darknet.
Learn about the MOAB data leak and find out how much of the exposed data is already known, public, or outdated per SpyCloud Labs research.
The cost of a data breach keeps rising but there are concrete approaches for mitigating costs that work. Read the key findings from this year’s IBM report.
New year, same story: Credentials are king, ransomware is rampant, and human error prevails. We dig into the Verizon 2023 Data Breach Investigations Report and shed some light on what the future holds.
We were able to tie more than 412 million breach assets within the SpyCloud database to employees within the Fortune 1000, providing a snapshot of the breach exposure affecting major enterprises.
NEW RESEARCH: Over 2/3 of orgs had an identity event last year – NHIs were the top cause. Read on →