In 2025 alone, 2.05 million infostealer logs exposed enterprise identity credentials, providing attackers with potential access to corporate email, cloud infrastructure, SaaS platforms, and internal systems. Preliminary data from late 2025 shows enterprise identity exposure surging to 16% of infections, well above model predictions, signaling a shift toward rapid acceleration.
As organizations consolidate authentication around centralized identity platforms like Microsoft Entra ID, Okta, and AWS IAM Identity Center, identity has become the gateway to nearly every enterprise system. While this centralization improves usability and baseline security, it also concentrates risk. A single compromised credential or session can unlock dozens of connected systems at once. Infostealers exploit this by harvesting all saved credentials and active sessions from infected machines, turning one infection into broad enterprise access.
“Centralized identity has become the control plane of the modern enterprise,” said Estelle Ruellan, cybersecurity researcher at Flare. “What this data shows is that attackers understand that shift very well. When an infostealer infection succeeds today, it’s increasingly likely to deliver direct access to the systems organizations depend on most.”
Key Findings from the 2026 State of Enterprise Infostealer Exposure Report
● Enterprise identity exposure more than doubled, rising from approximately 6% of infections in early 2024 to nearly 14% by late 2025.
● Microsoft Entra ID appears in 79% of enterprise identity logs, making it the most impacted identity provider by a wide margin.
● Over 18% of enterprise identity logs expose multiple identity providers, significantly increasing breach impact and complexity.
● 1.17 million logs contained both enterprise credentials and session cookies, enabling immediate access and potential MFA bypass.
Future Outlook for Enterprise Identity Exposure
Data from late 2025 shows a clear evolution in attacker behavior. Despite a 20% year-over-year decline in total infostealer infections, enterprise identity exposure continued to rise. Research shows that infostealers are increasingly linked to enterprise credential theft, reflecting the higher prevalence and value of enterprise access on compromised systems.
This divergence points to a structural shift in attacker economics: fewer infections with far greater impact when compromises occur. Flare researchers warn that if this trend holds, one in five infostealer infections could expose enterprise credentials as early as Q3 2026. Each successful infection carries greater business risk, delivering immediate access and reducing the time between initial compromise and enterprise impact.
