Modern infostealers have expanded credential theft far beyond usernames and passwords. Over the past year, campaigns have accelerated, targeting users with little distinction between corporate employees and individuals on personal devices. These infections routinely harvest credentials alongside broader session data and user activity. The resulting datasets are aggregated and sold by initial access brokers, then reused across attacks targeting both personal and enterprise environments. To better understand the scope and implications of this activity, Specops researchers analyzed more than 90,000 leaked infostealer dumps, comprising over 800 million rows of data collected during active infections. The datasets included credentials, browser cookies, browsing history, and system-level files…