Sophos, a cybersecurity solutions provider, reported an increase in identity-based cyberattacks, caused by the growing sale of stolen credentials on the dark web. Findings from the Sophos X-Ops Counter Threat Unit (CTU) showed a 106% increase in credentials offered for sale between June 2024 and June 2025, showing how identity theft has become one of the main entry points for cybercriminals.
In its latest Active Adversary Report, Sophos found that compromised credentials were the top cause of attacks for the second consecutive year. The study revealed that 56% of incidents investigated by the company’s Managed Detection and Response (MDR) and incident response teams involved attackers logging into remote systems using valid credentials.
“Cloud and remote work have expanded the identity attack surface and created new opportunities for attackers,” said Rob Harrison, SVP for product management of Sophos. “Complex identity and access management systems with constantly changing settings and policies create gaps that attackers target. Organizations need better visibility into identity risks and faster detection of compromised credentials to close those gaps.”
The company said identity-based threats have become harder to detect as businesses rely more on cloud platforms and remote access tools. Attackers are increasingly using legitimate credentials to move within networks undetected, often bypassing traditional security tools.
To help organizations address this issue, the company has launched the Sophos Identity Threat Detection and Response (ITDR), now integrated into its Sophos XDR and Sophos MDR platforms. The new solution continuously monitors systems for identity risks, misconfigurations, and leaked credentials. It also uses AI to detect identity-based attacks, such as privilege escalation, account takeover, and lateral movement.
The company’s ITDR automatically creates response cases when threats are detected, enabling analysts from Sophos MDR to investigate and act on behalf of customers. It said this helps organizations respond faster to identity-related threats and reduce overall security risks.