More than 97 million account credentials were stolen worldwide through malware between January and August 2026. During the same period, the number of computers infected with malware exceeded 2.8 million, while more than 1.4 million Android devices were also affected.
Malware silently collects information
Information-stealing malware most often infects devices through fake emails, pirated software and malicious links. The software can collect passwords stored in browsers, session cookies and personal information without users noticing and send them to attackers.
The stolen information includes passwords for email, social media and gaming accounts. According to Dark Radar's monitoring data, more than 94% of devices on which malware was detected did not have up-to-date and effective security software.
A single employee's device can put company systems at risk
Teoman Demirtaş, founder of Dark Radar and a cybersecurity expert, said that major company breaches can often begin with a single employee's computer. Demirtaş said the theft of a work password puts not only the employee but also the company's systems, customer information and financial records at risk.
According to Demirtaş, a free program downloaded onto an employee's home computer can steal login details for supplier portals or accounting software along with personal email passwords stored in the browser. This information can then be sold to other groups on dark markets, and companies may only discover the incident after customer information has been exposed.
Breaches can take months to detect
Demirtaş said most data breaches are not detected on the day of the attack; some incidents come to light weeks later, while others are discovered about a year afterward. IBM's 2025 data breach report found that it took an average of 241 days to identify and contain a breach.
Remote work creates new risks
Demirtaş said malware often exploits user behavior rather than a technical vulnerability, adding that clicking on fake advertisements, opening attachments from unknown senders and downloading pirated software are among the main risks.
Demirtaş noted that shared devices used in remote and hybrid work arrangements also pose a risk. He said that if another person using the same computer accesses malicious content for gaming or video purposes, corporate information could be put at risk.
Session cookies can bypass two-factor authentication
Demirtaş said attackers steal not only passwords but also session cookies from browsers. When these cookies are used, attackers can, in some scenarios, bypass two-factor authentication and access an account as if they had already logged in.
Emphasizing that changing a password alone may not be enough, Demirtaş recommended keeping two-factor authentication enabled and, in suspicious situations, signing out of all devices and closing active sessions.
Security recommendations for users
- Do not download pirated software or free software from untrusted sources.
- Do not click on advertisements that seem too good to be true or on attachments from unknown senders.
- Keep work and personal devices separate whenever possible.
- Use up-to-date security software on devices.
- In suspicious situations, close all active sessions in addition to changing the password.
