Microsoft research found the overwhelming majority of identity attacks target passwords, and that phishing-resistant MFA blocks over 99% of them.

IBM Cost of a Data Breach research showed a modest decline in average breach cost, driven by faster identification and containment.

Threat researchers reported a sharp rise in infostealer malware harvesting credentials and live session cookies, enabling attackers to bypass MFA.

Researchers described one of the largest aggregations of stolen credentials to date, largely sourced from infostealer logs and prior breaches.

The annual Data Breach Investigations Report again highlighted stolen credentials, phishing, and the human element as dominant breach factors.

Verification vendors reported rapid growth in deepfake and injection attacks against remote identity proofing, raising the bar for liveness detection.

Authorities warned that the Scattered Spider group continued to bypass MFA through help-desk social engineering and SIM swapping, hitting major enterprises.

Researchers reported a massive aggregation of previously leaked passwords, a reminder that credential reuse keeps fueling account-takeover attacks.