THE PASSWORD PLAGUE: Microsoft Confirms Surge in Identity Attacks Driven by Leaked Credentials and Social Engineering Warfare

It wasn’t a sophisticated zero-day exploit or a nation-state quantum decryptor that opened the gates to some of 2025’s most devastating cyberattacks. It was a password. Again.

Microsoft’s new 85-page Digital Defense Report 2025 delivers a sobering reminder that the most successful breach method isn’t always the most advanced — just the most repeated. In the first half of 2025 alone, identity-based attacks surged by 32%, with an overwhelming 97% of those involving basic password abuse. Despite all the global investment in AI defenses, endpoint detection, and threat modeling, attackers are still walking in through the front door — and they’re doing it with stolen usernames and passwords harvested from the internet’s ever-growing graveyard of credential dumps.

The data is clear. Hackers, both financially motivated and state-sponsored, are now escalating their campaigns not just by brute-force attempts or phishing kits, but by impersonating real people with real credentials. Contractors, employees, IT staff — no badge is safe when a password is all that stands in the way.

And it’s not just traditional credential leaks driving this wave. Microsoft’s report confirmed a dramatic rise in the use of infostealer malware — lightweight programs designed to exfiltrate login information and session tokens from infected devices without detection. Lumma Stealer, one of the most notorious tools in this category, became a primary weapon for cybercriminals until Microsoft and its partners moved to disrupt its infrastructure. But even with takedowns, new variants surface, mimicking the same techniques. The cycle is relentless. The payoff, enormous.

Adding fuel to the fire is the rise in what Microsoft calls “help desk-themed” social engineering — a manipulation tactic seen in recent Scattered Spider-linked attacks. Here, cybercriminals simply call corporate help desks pretending to be internal employees and request password resets. Some even use corporate messaging platforms like Microsoft Teams to impersonate co-workers. Quick Assist, a built-in Windows remote utility, is often exploited in tandem, giving attackers full access once trust is established.

These tactics have proven so effective that Microsoft has shifted to tracking individual threat actors — not by their malware signatures, but by the ransomware strains they rotate through. One cybercriminal tracked as Octo Tempest switched between Dragon Force, RansomHub, and Qilin ransomware throughout 2025, illustrating the fluidity of ransomware-as-a-service networks. In another case, a threat actor migrated between Vice Society, Rhysida, BlackCat, Quantum Locker, and Zeppelin — a ransomware carousel that makes attribution even harder for defenders.

The report highlights that ransomware remains one of the top objectives in targeted intrusions, with 19% of Microsoft’s incident response cases confirming ransomware deployment. Most of the victims exposed on ransomware leak sites were companies earning less than $50 million in annual revenue — a chilling sign that mid-sized businesses are now the most targeted.

A particularly troubling new trend involves the abuse of antivirus (AV) exclusions. Normally used by IT departments to improve performance by skipping scans of trusted files or directories, these AV exclusions are now being exploited. Attackers search for overly broad configurations and use them to disable or bypass security systems during active hands-on intrusions. Microsoft reported that AV exclusion abuse was present in 30% of all human-operated ransomware cases it investigated over the last year.

Despite this, there’s one silver lining: encryption-stage ransomware events are slowing. From July 2024 to June 2025, attacks that reached the point of full encryption grew only 7%, a marked improvement over the 102% spike seen the year before. Still, Microsoft cautions that this is no time for complacency. The infrastructure behind these attacks — from password harvesting to stealth malware distribution — is growing more resilient, more modular, and more adaptive.

Among the key vulnerabilities exploited during this window were CVE-2024-50623, which impacted file-sharing platform Cleo, as well as severe bugs in software made by Fortinet, BeyondTrust, and SimpleHelp. These gaps served as entry points into critical systems, especially for IT companies and government agencies — the two most targeted groups of the year.

Taken in full, Microsoft’s report outlines a deeply stratified threat landscape — one where malware is only half the battle. Identity theft, social engineering, infrastructure manipulation, and ransomware monetization are converging into a hybrid warzone that rewards precision, not chaos.

The password, once the simplest form of access control, has now become the most dangerous point of failure in modern digital security. As long as organizations rely on static credentials without multi-factor authentication or behavioral monitoring, the siege will continue. Hackers don’t need to break the system. They just need to log in.

And every leaked credential is an invitation.

Sponsored • TRJ Ads
Inquiries: contact@therealistjuggernaut.com

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE