A full set of credentials stolen off one infected computer sells for $10 to $50. If it includes corporate or bank logins, $100 and up.
That's from Microsoft's security team, in a breakdown of the two malware families behind most of this trade. The part worth your attention isn't the price — it's the clock.
Stolen credentials show up for sale within hours. Some get used to break in within 48 to 72 hours. Others sit dormant for months, waiting on a buyer.
For a wealth management firm, that quiet stretch is the dangerous part. Nothing breaks. Nobody gets locked out. The password still works, because it's still your password. The first sign is usually a wire request that didn't come from the client.
And multifactor isn't the backstop people assume it is here. The same malware steals session cookies. A stolen cookie lets someone resume a session you already approved — no login, no prompt, no code.
Credential monitoring is unglamorous by design: an alert the day your firm's email and password turn up in a dump, and a forced reset before anyone gets around to buying it. It shrinks that window from months to hours.
Worth asking whoever runs your IT whether anyone is actually watching — your next cyber renewal will probably ask you the same thing.
Want the next one in your inbox?
One practical Microsoft 365, Copilot, Azure, or security move per week — plain English, no pitch.
Subscribe via email