Microsoft Says Hackers Pivoting to Identity Compromise
Hackers are as likely to log in as break in, warns Microsoft in an annual assessment of cyberthreats.
See Also: Agentic Commerce: The Technology Shaping the Future of Payments
In a report published Thursday, Microsoft said it observed a “sharp change in how threat actors achieve initial access” this year.
During the first half of 2025, identity-based attacks rose by 32% due to credentials stolen by infostealers or hackers plugging in password and email combinations plucked from bulk data breaches, said Amy Hogan-Burney, corporate vice president, customer security and trust at Microsoft.
Such tactics are allowing attackers “from breaking in to signing in,” Hogan-Burney said.
Microsoft said there has been a “rapid rise” in the infostealer use. “Traditionally considered post-exploitation tools, malware families such as Lumma Stealer, RedLine, Vidar, Atomic Stealer and Raccoon Stealer are now increasingly deployed as first-stage payloads,” the computing giant said.
That shift has elevated infostealers into “foundational components of modern access campaigns.” Their rise has driven increased specialization in the cybercrime underground, resulting in hackers that specialize in initial access, brokers who monetize stolen credentials and ransomware groups who buy credentials to extort victims with crypto-locking software.
Microsoft coordinated with the federal government in May to seize Lumma infrastructure – although its operators only needed days to regroup from the police operation (see: Lumma Stealer Malware Resurgence Challenges Global Takedown).
Hackers have responded to increased uptake of obstacles to user impersonation such as multifactor authentication through increasingly sophisticated counter-hacks, Microsoft said. One new target of cybercrime are the secret stores that protect data such as tokens, API keys and certificates.
Hackers use social engineering techniques to sidestep multifactor authentication such as unleashing an email bombing run, in which attackers flood a victim’s inbox with unwanted subscription emails. Hackers this year have turned email bombing into precursor for a social engineering attack in which they impersonate IT support staff available to fix the overrun inbox.
This year has also seen the explosion of ClickFix attacks, attacks in which users are goaded into copying and pasting code into their systems under the guise of resolving a tech issue (see: Fresh Phishing Kit Innovation: Automated ClickFix Attacks).
Despite these innovations, Microsoft said the solution to the overwhelming majority of identity compromise attacks is simple: Multifactor authentication. MFA can stop more than 99% of identity hacks, the computing giant said.