Following the digital trail: what happens to data stolen in a phishing attack

This report outlines how data stolen in phishing campaigns is collected (email scripts, Telegram bots, and PaaS admin panels), aggregated and verified, then sold on dark‑web/Telegram markets and repurposed for further attacks, including targeted whaling, with prices varying by account value and protections. It highlights that January–September 2025 attacks primarily aimed at account credentials (88.5%), with smaller shares targeting personal data (9.5%) and bank card details (2%), and closes with practical guidance for containment and recovery (unique passwords, MFA, session reviews, breach checks, and alerting contacts).