A Glimpse into the “Search Your Target” Market for Stolen Credentials

Flare analyzed 470 underground posts (Jan 2025–Jun 2026) exposing a commercial "search your target" service layer that turns massive infostealer log collections (up to tens of billions of records) into searchable, filtered credential results for buyers; sellers advertise indexing, freshness, and formatted outputs (URL:LOGIN:PASS, MAIL:PASS, etc.), but customer feedback reports high invalidity and duplication. This service sits between infostealer infections and account takeover actors, increasing risk of fraud, corporate intrusion, and supply-chain exposure; defenders should monitor these markets, prioritize exposed credentials, enforce MFA, revoke sessions, and investigate suspicious access.