124M Passwords Exposed as Infostealer Malware Hits Millions of Devices
The era of hacking corporate databases may be giving way to something far more direct. Have I Been Pwned has added a massive collection of infostealer malware records containing 124 million passwords and 56 million email accounts. The credentials came from stealer logs created by malware that harvests sensitive information from infected devices. The dataset offers a snapshot of how cybercriminal tactics are evolving. As infostealer malware becomes more widespread, attackers are increasingly bypassing organizations altogether and collecting credentials directly from users, creating fresh and simpler opportunities for account takeovers and broader cyberattacks. What happened and why it matters The most striking detail isn’t when the data appeared — it’s how much of it exists. 56 million unique email addresses and 124 million unique passwords were included in the infostealer dataset added to Have I Been Pwned. While the collection was added on June 15, the platform did not specify when the credentials were originally stolen. What is clear is that the records came from malware-infected devices rather than corporate breaches, reflecting a growing shift …
