SpyCloud’s 2026 Identity Exposure Report Reveals Explosion of Non-Human Identity Theft

Why It Matters

The expanding attack surface beyond passwords forces enterprises to secure machine identities and session artifacts, or risk persistent, high‑impact breaches.

Key Takeaways

• 18.1M API keys and tokens exposed in 2025.
• Phishing records rose 400% YoY, 28.6M captured.
• 8.6B session cookies stolen, enabling MFA bypass.
• 80% corporate passwords stored in plaintext.
• Machine‑identity theft outpaces human credential attacks.

Pulse Analysis

The 2026 SpyCloud report confirms that non‑human identities have become a primary attack vector. Over 18 million API keys and authentication tokens were recaptured, spanning cloud providers, payment gateways and emerging AI services. Unlike user passwords, these machine credentials often lack multi‑factor enforcement and rotate infrequently, giving adversaries persistent footholds in production environments. As enterprises accelerate cloud migration and embed AI‑driven automation, the exposure of such assets can cascade into supply‑chain compromise and large‑scale data breaches. Consequently, compromised tokens can be leveraged to exfiltrate data or launch ransomware without ever needing a password.

Phishing activity exploded, with a 400 % year‑over‑year increase and nearly half of the 28.6 million compromised identities belonging to corporate users. Modern campaigns now harvest session cookies and MFA workflow data, allowing attackers to hijack authenticated sessions without triggering traditional alerts. The recent Europol‑Microsoft takedown of the Tycoon 2FA phishing‑as‑a‑service platform underscores the industrialisation of these operations. Defenders must therefore augment user‑training programs with behavioural analytics, token‑monitoring and real‑time revocation capabilities to neutralise credential‑less attacks. These token‑based attacks also bypass legacy security controls that focus solely on password anomalies.

The findings compel a shift from perimeter‑focused defenses to continuous identity threat protection. Integrating dark‑web recapture feeds with automated remediation can shrink the window of opportunity for both human and machine credential abuse. Solutions that combine AI‑driven anomaly detection, credential rotation policies and granular token revocation are becoming essential for Fortune 10 enterprises and mid‑market firms alike. As the attack surface expands, organisations that invest in holistic identity hygiene will better safeguard cloud workloads, AI pipelines and critical business processes against the next wave of credential‑driven threats. Adopting continuous monitoring platforms that surface anomalous token usage across cloud environments is now a best practice.