Compromised credentials expose the limits of password-centric PAM

At a glance

What this is: This is Arcon's analysis of a 16 billion-credential leak assembled from infostealer malware and underground dumps, highlighting how reused passwords, cookies, and linked login data remain exploitable at scale.

Why it matters: It matters because PAM and IAM teams still face credential reuse, vault sprawl, and weak hygiene assumptions that can turn one exposed secret into broad unauthorised access across enterprise systems.

By the numbers:

• 16 billion login credentials were exposed in the dataset, according to Arcon.

👉 Read Arcon's analysis of compromised credentials and password-centric PAM limits

Context

Compromised credentials remain a governance problem because identity proof at sign-in does not remove the value of stolen passwords, cookies, and linked login URLs. When those artefacts are reused across services, password-centric controls stop being a boundary and become an acceleration path for access abuse.

Arcon's article frames the issue as a massive credential aggregate rather than a single breach. That matters for PAM programmes because the operational risk is no longer just whether a password was guessed or reset, but whether credential material remains valid, shared, or recoverable across too many systems.

Key questions

Q: What breaks when passwords are treated as the main PAM control after credential theft?

A: Password-centric PAM breaks when attackers capture more than the password itself. Cookies, autofill data, and linked login URLs can preserve access even after a reset, so governance must treat the credential bundle, session material, and privilege scope as the real control surface.

Q: Why do stolen credentials and overprivileged accounts create such a high risk for unauthorized access in enterprise environments?

A: Stolen credentials are dangerous because they often work immediately, especially where MFA is weak or absent. Overprivileged accounts magnify the impact by giving an attacker more systems and data than the user actually needs. In practice, one compromised login can become broad access, faster lateral movement, and a much larger breach surface.

Q: How do teams know their credential hygiene is not keeping up with exposure?

A: The warning signs are repeated reuse, delayed resets, and live sessions that survive confirmed exposure. If exposed credentials remain valid long enough to be traded, replayed, or used against enterprise platforms, the programme is reacting too slowly to the way attackers actually monetise stolen login data.

Q: What should organisations do when compromised credentials involve both user accounts and privileged access?

A: They should treat the event as an access governance problem, not only a password problem. That means revoking or reissuing affected secrets, checking admin scope, and confirming that no shared or delegated access path still inherits trust from the compromised identity.

Technical breakdown

Why infostealer-collected credentials still bypass password-centric controls

Infostealer malware captures data from endpoints after the user has already authenticated, which means the attacker often receives more than a password. Saved browser credentials, autofill data, session cookies, and linked login URLs can be enough to replay access or move into adjacent services. Password-centric PAM assumes the secret itself is the primary control point, but that assumption weakens when the real attack material is a bundle of reusable identity artefacts rather than a single static password.

Practical implication: treat browser-stored credentials and cookies as governed secret material, not just the password vault entry.

Why scale and freshness change the attack economics

A credential dump becomes more dangerous when it is both large and current. Scale increases the odds of valid overlap with enterprise accounts, while freshness increases the chance that the data still works before resets, detection, or session expiry intervene. The article's key point is not merely that old leaks exist, but that recent infostealer output can be operationalised quickly across many targets. That compresses the response window for PAM, IAM, and fraud teams.

Practical implication: shorten the time between credential exposure detection and forced reauthentication, revocation, or rotation.

How privileged access expands the blast radius of reused credentials

Compromised credentials become far more damaging once they intersect with privileged or shared access. In enterprises with distributed admin accounts, shared logins, or weakly separated environments, one exposed identity can open multiple paths into systems that were never meant to share trust. This is where password management alone fails. The control problem is not only authenticating the user, but constraining what that identity can reach, reuse, or elevate into after the first sign-in.

Practical implication: pair credential hygiene with privileged access scoping so stolen logins cannot become broad admin pathways.

Threat narrative

Attacker objective: The attacker objective is to convert harvested login material into repeatable access for account takeover, fraud, and deeper enterprise compromise.

1. Entry occurs when infostealer malware harvests saved passwords, cookies, and linked login URLs from endpoints and browser stores.
2. Credential abuse follows when the stolen material is assembled into reusable login sets and circulated through underground forums and dumps.
3. Escalation happens when reused or privileged credentials provide access to enterprise platforms, shared environments, or sensitive systems.
4. Impact is unauthorised access, identity theft, phishing, fraud, and the widening of attack surface across organisations and users.

Breaches seen in the wild

• BeyondTrust breach 2024: A stolen BeyondTrust Remote Support API key let a China state-sponsored actor reset accounts and reach US Treasury workstations in 2024.
• Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Credential reuse has become a governance failure, not just a user behaviour problem. When login material from endpoints is easy to aggregate and replay, the issue is no longer whether one user chose a weak password. The real weakness is that many programmes still assume a credential can be treated as a stable trust object after first issuance. Practitioners need to govern how identity artefacts are captured, stored, shared, and invalidated across the full lifecycle.

Compromised credentials now create identity blast radius. A single reused password or session token can expose multiple systems when accounts, cookies, and linked login data are not tightly scoped. That makes blast-radius reduction the decisive control objective, because the attacker does not need to defeat every boundary. They only need one identity path that still inherits trust from too many places. The implication is that access design must assume credential material will be reused elsewhere.

Password-centric PAM leaves too much of the attack surface outside the control plane. Vaulting and rotation still matter, but they are not enough when the most dangerous artefacts include cookies, autofill data, and linked login URLs. This is where the named concept of credential portability debt becomes useful: every place a credential can be copied, replayed, or reassembled is a place where governance loses sight of effective access. Practitioners should treat portability itself as a risk signal.

Privileged access governance must assume compromise before first alert. The article shows that stolen credentials can be fresh, circulated quickly, and used before normal review cycles catch up. That means access review alone is too slow a control if the identity material has already left the environment. The practitioner implication is to move more control to issuance, scoping, and continuous verification rather than relying on periodic cleanup.

The strongest response is not more password policy, but narrower trust. Organisations that still let shared logins, reused secrets, and broad admin scope coexist are preserving the conditions that make large credential leaks exploitable. This is a PAM problem, an IAM problem, and a fraud problem at the same time. The governance conclusion is straightforward: trust should shrink faster than credential exposure can spread.

From our research library:

• 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
• 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
• Read next: Ultimate Guide to NHIs — Key Challenges and Risks

What this signals

Credential portability debt: The core governance issue is not only that credentials leak, but that they can be copied into places PAM does not fully govern, including browser stores and linked login flows. Once that happens, periodic rotation becomes a lagging control unless it is paired with session invalidation and stricter issuance rules.

The article reinforces a simple programme signal: if your privilege model still assumes passwords are the only reusable secret that matters, your control boundary is already too narrow. In practice, teams should align PAM, endpoint hygiene, and access governance so stolen login material cannot survive long enough to be operationalised.

For practitioners

• Inventory credential-bearing artefacts beyond passwords Map where browser-stored passwords, cookies, autofill data, and linked login URLs exist across managed and unmanaged endpoints. Classify them as sensitive authentication material and include them in offboarding, incident response, and exposure monitoring.
• Reduce reuse across privileged and shared accounts Eliminate shared admin logins where possible and enforce unique identities for administrative access, especially in distributed environments. Reused credentials should be treated as a control defect because they turn one leak into many reachable systems.
• Shorten the exposure window after credential theft Trigger forced reauthentication, password resets, token invalidation, and session review as soon as credential exposure is confirmed. The goal is to remove live access before stolen material is weaponised in underground forums or reused against enterprise services.
• Bind privileged access to tighter scoping and monitoring Limit admin reach so a compromised login cannot traverse unrelated systems or shared environments. Pair that with monitoring for anomalous reuse patterns, because blast radius is driven as much by scope as by the initial compromise.
• Audit credential hygiene at the endpoint layer Check whether endpoint protection, browser controls, and user-awareness measures are actually reducing the capture of secrets on managed devices. If infostealers can still extract usable login material, the access model is assuming too much about endpoint trust.

Key takeaways

• The article shows that credential compromise is now a scale problem, not a single-password problem, because stolen login material is assembled from many sources and reused quickly.
• Arcon cites 16 billion exposed credentials, which is enough to make freshness, reuse, and linked login artefacts more operationally dangerous than password policy alone.
• The practical response is to shrink trust faster than stolen credentials can spread, by tightening scope, invalidating sessions, and governing all authentication artefacts, not just passwords.

Key terms

• Portability debt: The accumulated cost of being unable to move data, identities, policies, or workflows out of one platform cleanly. It grows when technical integration is built around proprietary assumptions, making offboarding, migration, and control assurance harder over time.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Credential Hygiene: Credential hygiene is the discipline of creating, storing, using, and separating passwords and secrets in a controlled way. It includes avoiding reuse, keeping work and personal accounts separate, and making the governed path easy enough that people do not work around it.
• Session invalidation: The forced termination of active authenticated sessions after a security-relevant event such as password reset, recovery change, or token reuse. It prevents an attacker from retaining access through an old session even after the primary credentials have been changed.

What's in the full report

Arcon's full article covers the operational detail this post intentionally leaves for the source:

• How the 16 billion credentials were assembled from infostealer malware and underground dumps
• Why linked login URLs and cookies make reused credentials harder to contain than passwords alone
• The article's practical advice on credential vaulting, rotation, and default admin password avoidance
• Context on why this leak matters for organisations with distributed privileged access

👉 Arcon's full article covers the scale, freshness, and enterprise implications of the credential leak in more operational detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.