SpyCloud’s 2026 Identity Exposure Report documents a sharp expansion in the theft and weaponization of non-human identities, including API keys, session tokens, and automation credentials, as attackers shift focus from traditional username-and-password combinations to machine-based access paths.
The company said its recaptured identity data lake grew 23 percent year over year to 65.7 billion distinct identity records. Within that, SpyCloud recovered 18.1 million exposed API keys and tokens in 2025, spanning payment platforms, cloud infrastructure providers, developer ecosystems, collaboration tools, and AI services. It also identified 6.2 million credentials or authentication cookies tied to AI tools, reflecting the rapid enterprise adoption of AI platforms and the associated expansion of machine-based access.
Unlike human credentials, non-human identities often lack multi-factor authentication enforcement, rotate infrequently, and operate with broad permissions. When exposed, they can give attackers persistent access to production systems, software supply chains, and cloud infrastructure.
The report also found that SpyCloud recaptured 28.6 million phished identity records in 2025, with nearly half tied to corporate users. Successful phishing attacks have surged 400 percent year over year, according to the company, making enterprise workers now three times more likely to be targeted by phishing than by infostealer malware.
Session hijacking remains a major vector. SpyCloud recaptured 8.6 billion stolen cookies and session artifacts from malware infections, and found that 51 percent of records in underground combolists overlapped with previously observed infostealer logs, indicating that criminals are repackaging malware-exfiltrated data rather than relying solely on fresh breach disclosures.
“Attackers are no longer just targeting credentials,” said Trevor Hilligoss, Chief Intelligence Officer at SpyCloud. “They’re stealing authenticated access, including API keys, session tokens and automation credentials, and using this access to move faster, stay persistent, and scale attacks across cloud and enterprise environments.”
The findings align with broader industry concern about machine identity governance. Saviynt and Wiz partnered earlier this year to address the management of service accounts, API keys, and automated agent credentials across enterprise cloud systems.
Sources: Security Boulevard, SpyCloud
–
By the ID Tech Editorial Team
