Cybersecurity statistics / Credential Theft

Credential harvesting is identified as the initial threat in 36% of ransomware incidents.

Publisher	Proofpoint
Report	2026 AI-Era Ransomware Report
Published	22 July 2026
Topics	Credential Theft, Ransomware, Threat Vectors

Published by Proofpoint in 2026 AI-Era Ransomware Report, 22 July 2026. The figure is taken from the report as published; the full methodology is in the source.

View the original report

Related statistics

Malicious links are identified as the initial threat in 47% of incidents, malicious attachments in 46%, credential harvesting in 36%, and Business Email Compromise in 35%.

Proofpoint, 25/07/2026

11% of the top 100 vendors most commonly used by universities currently show evidence of active infostealer malware infections.

UpGuard, 04/07/2026

43% of internal authentication traffic still relies on NTLM, a legacy protocol frequently abused for credential replay and privilege escalation attacks.

Zero Networks, 15/06/2026

72% of organizations do not detect credential misuse in real time, often taking hours or sometimes days or weeks to identify unauthorized privileged access.

Keeper Security, 27/05/2026

45% of MSPs who reported BYOD-related security incidents cite credential theft or account compromise as a cause

Omdia & Aura Business, 27/05/2026

Credential-stealer infections were dominated by RedLine with 911,968 infections (50.80%), Lumma with 499,784 infections (27.84%), and Vidar with 236,778 infections (13.19%).

Fortinet, 27/05/2026

Get the newsletter

Weekly cybersecurity statistics by email.