Non-Human Identity Theft Explosions: SpyCloud's 2026 Identity Exposure Report

Post Views: 7

2026 Identity Exposure Report Reveals Surge in Non-Human Identity Theft

The 2026 Identity Exposure Report from SpyCloud reveals a significant surge in non-human identity theft, with attackers increasingly targeting machine identities and authenticated session artifacts. The report analyzed 65.7 billion distinct identity records and found a 23% increase in recaptured identity data.

According to Trevor Hilligoss, Chief Intelligence Officer at SpyCloud, “We’re witnessing a structural shift in how identity is exploited. Attackers are no longer just targeting credentials, but also stealing authenticated access, including API keys, session tokens, and automation credentials.”

Key Findings

The report highlights several key findings, including the exposure of 18.1 million API keys and tokens, and 6.2 million credentials or authentication cookies tied to AI tools. These non-human identities often lack multi-factor authentication enforcement, rotate infrequently, and operate with broad permissions, making them a prime target for attackers.

Phishing Remains a Persistent Threat

Phishing remains a persistent enterprise threat, with 28.6 million phished identity records recaptured in 2025. Nearly half of these identities belonged to corporate users, and the report notes that successful phishing attacks have surged 400% year-over-year. Modern phishing datasets often contain more than just credentials, including session cookies, authentication tokens, and MFA workflow data, allowing attackers to assume authenticated sessions without triggering traditional alerts.

Session Theft and MFA Bypass

Session theft and MFA bypass continue to be a major concern, with 8.6 billion stolen cookies and session artifacts exposed through malware infections. The report also notes that 51% of records overlapped with previously observed infostealer logs, indicating that criminals are increasingly repackaging malware-exfiltrated data rather than relying solely on fresh breach disclosures.

Malware and Credential Exposure

Malware continues to exfiltrate identity data, with 642.4 million exposed credentials recaptured from 13.2 million infostealer malware infections in 2025. The report notes that a notable portion of infections occurred on endpoints with EDR or antivirus tools installed, highlighting the need for additional security measures.

Credential exposure remains high, with 5.3 billion credential pairs stolen, including usernames or addresses and passwords. Weak password hygiene is a major concern, with 80% of exposed corporate credentials containing plaintext passwords. Predictable patterns tied to pop culture, sports, and short numeric strings continue to be used broadly, and password reuse remains widespread.

Conclusion

The report highlights the need for continuous identity threat protection across both human and machine identities. Attackers are combining breach data, phishing captures, malware logs, session tokens, and machine credentials to construct composite identity profiles that fuel various types of attacks.

As organizations accelerate cloud adoption and embed AI tools across workflows, machine identities are becoming deeply integrated into critical systems. The theft of these credentials and authentication tokens can create downstream ripple effects far beyond a single compromised account.