Credentials for sale: Mapping the market behind cybercrime’s biggest commodity

This report analyzes the credential-theft economy: how infostealers harvest credentials and cookies and how criminals monetize them via subscription-based Telegram clouds, precision bot storefronts, niche websites selling bank logs, and vertically integrated markets (e.g., Lumma). It quantifies subscription and account pricing, buyer preferences, cash-out mechanisms, and highlights major takedowns (Operation Magnus and Operation Endgame) while noting the ecosystem’s resilience and high profitability.