The shift is a broker layer that turns raw infostealer noise into company-specific credential hits. That lowers the skill barrier for account takeover because buyers can order a filtered search for a target instead of digging through bulk dumps themselves.
Flare counted 470 underground forum posts from January 2025 through June 2026 showing these services offering searches by company, domain, platform, geography, and account type. The market sits between infostealer collections and account takeover, with sellers filtering, deduplicating, formatting, and sometimes claiming freshness before handing over results.
The practical gap is that exposed-credential monitoring now has to account for a middleman that can generate a shortlist on demand, not just dump credentials for someone else to sift through.