IBM: Credential theft surges, ransomware drops in 2024

Cybercriminals focused on stealing login information rather than launching high-impact ransomware attacks in 2024, according to IBM’s newly released 2025 X-Force Threat Intelligence Index. 

IBM X-Force recorded an 84% increase in phishing emails delivering infostealers compared to the previous year. These infostealers are lightweight malware tools that extract login data and other sensitive information from devices, enabling cybercriminals to gain unauthorized access to systems without raising alarms.

“Cybercriminals are most often breaking in without breaking anything — capitalizing on identity gaps overflowing from complex hybrid cloud environments that offer attackers multiple access points,” said Mark Hughes, global managing partner of Cybersecurity Services at IBM.

The annual report highlights a shift toward quieter, more scalable methods of cybercrime, with credential theft growing and identity-based attacks replacing some of the lost momentum in ransomware activity.

Accelerating identity-based attacks

IBM’s threat intelligence team found that nearly 1 in 3 security incidents involved credential theft. Instead of encrypting data for ransom, more attackers chose to steal and sell it. Infostealers enable quick access to credentials, making identity-based attacks both faster and cheaper to carry out.

“Businesses need to shift away from an ad-hoc prevention mindset and focus on proactive measures such as modernizing authentication management, plugging multi-factor authentication holes, and conducting real-time threat hunting to uncover hidden threats before they expose sensitive data,” Hughes said.

Critical infrastructure remained a major target in 2024. IBM X-Force reported that 70% of the incidents it handled last year affected this sector, with more than a quarter of those attacks linked to vulnerability exploitation. Many organizations still struggle with slow patching and outdated systems, making them easy targets.

Nation-state cyber attackers

On the dark web, threat actors are openly sharing exploit code for vulnerabilities tied to nation-state attackers. These are often aimed at energy, healthcare, and industrial systems. The growing market for these tools shows the rising collaboration between financially motivated criminals and more advanced adversaries.

Phishing campaigns using AI also grew more common. Early 2025 data shows a 180% increase in phishing emails with embedded infostealers compared to 2023. Attackers are using generative AI (GenAI) to create convincing messages that trick users into giving up credentials.

Dark web marketplaces reflect this trend, with over eight million listings in 2024 for the top 5 infostealers. Some even include kits for adversary-in-the-middle phishing, allowing attackers to bypass multi-factor authentication protections.

Targeting AI systems

While ransomware still accounted for the largest type of malware (28%) in 2024, IBM observed fewer incidents. International efforts to take down botnets pushed groups to move toward smaller-scale and more evasive operations.

Emerging threats also include those targeting artificial intelligence systems. IBM X-Force found vulnerabilities in AI agent frameworks that could be exploited. As AI adoption increases, attackers are expected to develop more specialized tools to go after these systems.

Asia and North America were the most targeted regions, making up 60% of the attacks IBM tracked globally. Manufacturing, particularly vulnerable to disruptions, was again the hardest hit by ransomware.