Identity · 84 days ago
The shift is a broker layer that turns raw infostealer noise into company-specific credential hits. That lowers the skill barrier for account takeover because buyers can order a filtered search for a target instead of digging through bulk dumps themselves.
Flare counted 470 underground forum posts from January 2025 through June 2026 showing these services offering searches by company, domain, platform, geography, and account type. The market sits between infostealer collections and account takeover, with sellers filtering, deduplicating, formatting, and sometimes claiming freshness before handing over results.
The practical gap is that exposed-credential monitoring now has to account for a middleman that can generate a shortlist on demand, not just dump credentials for someone else to sift through.
1 source covering this story
A Glimpse into the “Search Your Target” Market for Stolen Credentials
Flare explores how an emerging underground market searches stolen credential databases for specific companies, domains, and accounts.
Part of the PlainSec briefing for 2026-06-23